# IKE

> IKE negotiates IPsec VPN tunnels. Attackers enumerate transform sets, fingerprint vendors, exploit aggressive mode to capture PSKs, and crack weak credentials to gain VPN access

- **URL:** https://hackindex.io/services/ike
- **Type:** Service
- **Default ports:** 4500
- **Tags:** ike, vpn, ipsec, network, udp, handshake
- **Published:** 2026-02-21
- **Updated:** 2026-07-14

IKE (Internet Key Exchange) is the protocol used to set up IPsec VPN tunnels. It runs on **UDP port 500** for standard negotiation and **UDP port 4500** for NAT traversal (NAT-T). Nmap identifies the service as `isakmp`. IKE exists in two versions: IKEv1 and IKEv2, each with different security properties.

VPN gateways are high-value targets because they provide direct network access when compromised. IKEv1 Aggressive Mode leaks the group name (pre-shared key identifier) in cleartext, enabling offline brute-forcing of the pre-shared key. Weak or default pre-shared keys, outdated encryption proposals (DES, MD5), and known vendor-specific vulnerabilities are common findings on VPN appliances from Cisco, Fortinet, and others.

Enumeration starts with `ike-scan` to fingerprint the VPN gateway, determine the IKE version, identify supported transforms, and detect Aggressive Mode. Nmap's `ike-version` script provides similar information. Once a valid transform set is identified, testing for weak pre-shared keys and attempting to establish a tunnel are the next steps. Tools like `ikeforce` automate group name enumeration and PSK cracking.

## Phases

- [Enumeration](https://hackindex.io/services/ike/enumeration.md): IKE detection, transform set probing, and vendor ID fingerprinting guides (3 guides)
- [Vulnerability Discovery](https://hackindex.io/services/ike/vulnerability-discovery.md): IKE vuln guides: aggressive mode, weak ciphers, IKEv1 detection (3 guides)
- [Exploitation](https://hackindex.io/services/ike/exploitation.md): PSK capture, cracking, and weak transform VPN access guides (2 guides)