# IKE Transform Set Enumeration

- **URL:** https://hackindex.io/services/ike/enumeration/ike-transform-set-enumeration
- **Path:** IKE > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ike/enumeration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-30

An IKE gateway accepts connections only from peers that propose a matching set of cryptographic parameters: the transform set. Enumerating every accepted combination tells you the full attack surface: which weak algorithms are permitted, whether PSK authentication is accepted, and what is needed to establish a valid negotiation for exploitation.

The initial service detection probe returns one accepted transform. This page covers systematically extracting all of them.

## ike-scan with a Single Transform

ike-scan sends a proposal with one transform set per probe. Specify the components manually:

```bash
sudo ike-scan --trans=5,2,1,2 $TARGET_IP
```

The four numbers map to: `encryption,hash,auth,dh-group`

Common values:

| Field | Value | Meaning |
| --- | --- | --- |
| Encryption | 1 | DES |
| Encryption | 5 | 3DES |
| Encryption | 7 | AES-128 |
| Hash | 1 | MD5 |
| Hash | 2 | SHA1 |
| Hash | 4 | SHA2-256 |
| Auth | 1 | PSK |
| Auth | 3 | RSA signatures |
| DH Group | 1 | modp768 |
| DH Group | 2 | modp1024 |
| DH Group | 5 | modp1536 |
| DH Group | 14 | modp2048 |

A `Handshake returned` response means the gateway accepted that transform. A `Notify` or no response means it was rejected.

## Scripted Enumeration with ikeforce

ikeforce automates the transform set sweep, testing all common combinations and reporting which ones the gateway accepts:

```bash
python2 ikeforce.py $TARGET_IP -a
# [*] Scanning with: Enc=DES, Hash=MD5, Auth=PSK, DH=1
# [*] Scanning with: Enc=DES, Hash=SHA1, Auth=PSK, DH=1
# [+] Found accepted transform: Enc=3DES, Hash=SHA1, Auth=PSK, DH=2
# [+] Found accepted transform: Enc=AES, Hash=SHA2-256, Auth=PSK, DH=14
```

Each `[+]` line is a working combination. Record all of them: the weakest accepted transform matters most for the vulnerability assessment.

## Manual Sweep with ike-scan

If ikeforce is not available, sweep manually with a loop. Write a short list of transforms to test and iterate:

```bash
for trans in "1,1,1,1" "1,2,1,1" "5,1,1,2" "5,2,1,2" "7,1,1,2" "7,2,1,2" "7,4,1,14"; do
  result=$(sudo ike-scan --trans=$trans $TARGET_IP 2>/dev/null)
  if echo "$result" | grep -q "Handshake returned"; then
    echo "ACCEPTED: $trans"
  fi
done
```

## IKEv2 Transform Enumeration

IKEv2 uses a slightly different structure. ike-scan supports IKEv2 probes with the `--ikev2` flag:

```bash
sudo ike-scan --ikev2 $TARGET_IP
```

IKEv2 encryption attribute values differ from IKEv1. The important thing to confirm with IKEv2 is whether weak DH groups (1, 2, 5) are accepted alongside modern ones: a gateway that accepts both creates downgrade opportunities.

## What to Record

After sweeping, document:

- Every accepted transform combination
- Whether PSK (`Auth=1`) is accepted: required for offline cracking attacks
- The weakest accepted cipher: DES and 3DES are broken, MD5 is weak
- The weakest accepted DH group: groups 1 and 2 are considered broken
- Whether Aggressive Mode is accepted: covered in [IKEv1 Aggressive Mode Enabled](https://hackindex.io/services/ike/vulnerability-discovery/ike-aggressive-mode-enabled)

Any accepted weak transforms feed directly into [Weak IKE Transform Sets](https://hackindex.io/services/ike/vulnerability-discovery/ike-weak-transform-sets).

## References

- [NTA Monitor: ike-scan](https://www.nta-monitor.com/tools-resources/security-tools/ike-scan) - Transform set specification syntax and IKEv1/IKEv2 attribute values
- [SpiderLabs/ikeforce](https://github.com/SpiderLabs/ikeforce) - ikeforce: automated IKE enumeration and PSK cracking tool with transform sweep mode