Skip to content
HackIndex logo

HackIndex

IKE Vendor ID Fingerprinting

3 min read Mar 30, 2026

IKE gateways include Vendor ID (VID) payloads in their handshake responses. These are MD5 hashes or fixed byte strings that identify the software implementation — Cisco, Checkpoint, Fortinet, strongSwan, openswan, and others all have known VID signatures. Matching a VID to a known product tells you what CVEs to check, what default credentials to try, and how the implementation behaves under unusual inputs.

Extract VIDs with ike-scan

ike-scan prints VID payloads by default when it receives a handshake response:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan $TARGET_IP 
10.10.10.5	Main Mode Handshake returned
	HDR=(CKY-R=abc123def456)
	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=28800)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
	VID=090000233b7e24e28d6f2e5a84d7232e (Cisco Unity)
	VID=12f5f28c457168a9702d9fe274cc0100 (Cisco VPN Concentrator)

Each VID= line is a vendor identification payload. The hex string is the raw value; ike-scan decodes known ones automatically.

Force more verbose VID output:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan -v $TARGET_IP
Explain command
-v Enable verbose output to show detailed scan progress.
$TARGET_IP Target IP address to perform the IKE scan against.

Fingerprint with the --showbackoff Flag

Some implementations include timing characteristics that identify them. The --showbackoff flag measures how the gateway retransmits IKE packets:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --showbackoff $TARGET_IP 
10.10.10.5	Implementation guess: Cisco VPN Concentrator 3000
	Retransmit pattern:  0 5 15 34 74
Explain command
--showbackoff Display the backoff fingerprint table after scanning to identify IKE implementation.
$TARGET_IP Target IP address variable for the IKE scan.

Timing patterns are a secondary signal — use them when VIDs are minimal or absent.

ike-scan VID Database

ike-scan ships with a local VID database. Check it for a match manually if automatic decoding fails:

┌──(kali㉿kali)-[~]
└─$ cat /usr/share/ike-scan/ike-vendor-ids | grep -i cisco
┌──(kali㉿kali)-[~]
└─$ cat /usr/share/ike-scan/ike-vendor-ids | grep -i fortinet
┌──(kali㉿kali)-[~]
└─$ cat /usr/share/ike-scan/ike-vendor-ids | grep -i checkpoint
Explain command
-i Performs case-insensitive pattern matching.

If the raw hex is not decoded automatically, copy it and search manually:

┌──(kali㉿kali)-[~]
└─$ grep "090000233b7e24e2" /usr/share/ike-scan/ike-vendor-ids
Explain command
"090000233b7e24e2" Search pattern string to match against vendor ID entries in the file.
/usr/share/ike-scan/ike-vendor-ids Target file containing known IKE vendor ID fingerprints to search within.

What VIDs Reveal

VID / String

Product

Cisco Unity VID

Cisco VPN Concentrator / ASA

XAUTH VID

Extended authentication (XAUTH) supported — credential attacks possible

Dead Peer Detection

DPD keepalives — useful for knowing tunnel state

strongSwan VID

Linux strongSwan — check version against CVEs

openswan VID

Linux openswan — check version against CVEs

Checkpoint VID

Check Point firewall/VPN

Heartbeat Notify

Some Fortinet implementations

XAUTH support is particularly notable — if the gateway supports XAUTH (Extended Authentication), it may accept username/password after PSK negotiation, opening credential brute-force paths beyond PSK cracking.

Follow-up from VID Results

Once you have a product identification:

  • Search for known CVEs against that specific product and version

  • Check vendor default PSK values and common PSK wordlists for that platform

  • Look up whether that version has known Aggressive Mode weaknesses

  • Check if XAUTH is indicated — if so, credential attacks against the VPN login are in scope

Version information from VIDs feeds directly into IKEv1 Only Support Check and the exploitation phase.

References