IPP / CUPS

IPP (Internet Printing Protocol) is the standard protocol for network printing, and CUPS (Common UNIX Printing System) is the most widely used IPP implementation on Linux and macOS. IPP listens on TCP port 631. Nmap identifies the service as ipp. CUPS also provides a web-based administration interface on the same port.

Print servers are often overlooked during hardening but present real attack surface. Unauthenticated access to the CUPS web interface can reveal printer configurations, job histories, and network architecture details. Critical vulnerabilities in CUPS have allowed remote code execution, including the 2024 cups-browsed RCE chain (CVE-2024-47176 and related) that demonstrated how an attacker can create a malicious printer and execute commands when a print job is sent to it.

Enumeration involves browsing the CUPS web interface for printer lists, completed jobs, and configuration files. IPP attributes can be queried with ipptool to reveal make, model, firmware versions, and network details. Testing for unauthenticated admin access, job manipulation, and known CVEs are standard checks during a print service assessment.