Skip to content
HackIndex.io

IKE Vendor ID Fingerprinting

3 min read Created Mar 16, 2026 Last updated Mar 30, 2026

IKE gateways include Vendor ID (VID) payloads in their handshake responses. These are MD5 hashes or fixed byte strings that identify the software implementation: Cisco, Checkpoint, Fortinet, strongSwan, openswan, and others all have known VID signatures. Matching a VID to a known product tells you what CVEs to check, what default credentials to try, and how the implementation behaves under unusual inputs.

Extract VIDs with ike-scan

ike-scan prints VID payloads by default when it receives a handshake response:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan $TARGET_IP 
10.10.10.5	Main Mode Handshake returned
	HDR=(CKY-R=abc123def456)
	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=28800)
	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
	VID=090000233b7e24e28d6f2e5a84d7232e (Cisco Unity)
	VID=12f5f28c457168a9702d9fe274cc0100 (Cisco VPN Concentrator)

Each VID= line is a vendor identification payload. The hex string is the raw value; ike-scan decodes known ones automatically.

Force more verbose VID output:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan -v $TARGET_IP
Explain command
-v Enable verbose output to show detailed scan progress.
$TARGET_IP Target IP address to perform the IKE scan against.

Fingerprint with the --showbackoff Flag

Some implementations include timing characteristics that identify them. The --showbackoff flag measures how the gateway retransmits IKE packets:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --showbackoff $TARGET_IP 
10.10.10.5	Implementation guess: Cisco VPN Concentrator 3000
	Retransmit pattern:  0 5 15 34 74
Explain command
--showbackoff Display the backoff fingerprint table after scanning to identify IKE implementation.
$TARGET_IP Target IP address variable for the IKE scan.

Timing patterns are a secondary signal: use them when VIDs are minimal or absent.

ike-scan VID Database

ike-scan ships with a local VID database. Check it for a match manually if automatic decoding fails:

┌──(kali㉿kali)-[~]
└─$ cat /usr/share/ike-scan/ike-vendor-ids | grep -i cisco
┌──(kali㉿kali)-[~]
└─$ cat /usr/share/ike-scan/ike-vendor-ids | grep -i fortinet
┌──(kali㉿kali)-[~]
└─$ cat /usr/share/ike-scan/ike-vendor-ids | grep -i checkpoint
Explain command
-i Performs case-insensitive pattern matching.

If the raw hex is not decoded automatically, copy it and search manually:

┌──(kali㉿kali)-[~]
└─$ grep "090000233b7e24e2" /usr/share/ike-scan/ike-vendor-ids
Explain command
"090000233b7e24e2" Search pattern string to match against vendor ID entries in the file.
/usr/share/ike-scan/ike-vendor-ids Target file containing known IKE vendor ID fingerprints to search within.

What VIDs Reveal

VID / String

Product

Cisco Unity VID

Cisco VPN Concentrator / ASA

XAUTH VID

Extended authentication (XAUTH) supported: credential attacks possible

Dead Peer Detection

DPD keepalives: useful for knowing tunnel state

strongSwan VID

Linux strongSwan: check version against CVEs

openswan VID

Linux openswan: check version against CVEs

Checkpoint VID

Check Point firewall/VPN

Heartbeat Notify

Some Fortinet implementations

XAUTH support is particularly notable: if the gateway supports XAUTH (Extended Authentication), it may accept username/password after PSK negotiation, opening credential brute-force paths beyond PSK cracking.

Follow-up from VID Results

Once you have a product identification:

  • Search for known CVEs against that specific product and version

  • Check vendor default PSK values and common PSK wordlists for that platform

  • Look up whether that version has known Aggressive Mode weaknesses

  • Check if XAUTH is indicated: if so, credential attacks against the VPN login are in scope

Version information from VIDs feeds directly into IKEv1 Only Support Check and the exploitation phase.

References