Skip to content
HackIndex logo

HackIndex

IPP/CUPS Service Detection

3 min read Apr 4, 2026

IPP (Internet Printing Protocol) runs on port 631 and is implemented by CUPS on Linux/Unix systems and by many network printers directly. CUPS is the most common target — it runs a web administration interface on the same port that is often misconfigured to accept connections from any host. The CUPS RCE chain (CVE-2024-47176) disclosed in September 2024 made IPP a high-priority attack surface on any exposed Linux server. Always check port 631 during host enumeration on Linux targets.

Port Detection

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 631 $TARGET_IP 
631/tcp open  ipp     CUPS 2.4.2
Explain command
-sV Probe open ports to determine service/version info.
-p 631 Scan only port 631 (IPP - Internet Printing Protocol).
$TARGET_IP Placeholder for the target host IP address.

CUPS version from the banner is immediately useful — cross-reference against CVE-2024-47176 (affects CUPS before 2.4.11 / cups-browsed before 2.0.1) and older known vulnerabilities. A network printer speaking IPP will return a different banner — apply the printer enumeration methodology from printer and queue enumeration.

NSE Script Enumeration

┌──(kali㉿kali)-[~]
└─$ nmap -p 631 $TARGET_IP --script ipp-info 
| ipp-info:
|   printer-uri: ipp://10.10.10.50:631/printers/HP_LaserJet
|   printer-name: HP_LaserJet
|   printer-make-and-model: HP LaserJet 4050 Series
|   printer-location: Server Room
|   printer-info: Main printer
|   cups-version: 2.4.2
|_  ipp-versions-supported: 1.0 1.1 2.0
Explain command
-p 631 Scan only port 631 (Internet Printing Protocol).
$TARGET_IP Placeholder for the target host IP address.
--script ipp-info Run NSE script to enumerate IPP printer information.
┌──(kali㉿kali)-[~]
└─$ nmap -p 631 $TARGET_IP --script ipp-info,http-title,http-auth-finder
Explain command
-p 631 Scan only port 631 (Internet Printing Protocol).
$TARGET_IP Placeholder for the target host IP address.
--script ipp-info,http-title,http-auth-finder Run NSE scripts to enumerate IPP info, HTTP title, and auth methods.

The printer-location field sometimes reveals physical location details useful for physical security assessment. The CUPS version in cups-version is the authoritative version string for CVE matching.

CUPS Web Interface Check

CUPS hosts a web admin interface on port 631. Check accessibility and authentication requirements:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:631/ | grep -iE 'title|cups|version' 
<title>Home - CUPS 2.4.2</title>
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure SSL/TLS connections, skipping certificate verification.
http://$TARGET_IP:631/ Target URL using variable IP on port 631 (CUPS web interface).
-iE Case-insensitive search with extended regex pattern matching.
'title|cups|version' Regex pattern matching title, cups, or version strings in output.
┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:631/admin/ | grep -iE 'HTTP|www-authenticate|location' 
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="CUPS"
Explain command
-s Silent mode; suppresses progress and error output.
-k Allow insecure TLS connections, skipping certificate verification.
-I Send a HEAD request to fetch HTTP headers only.
http://$TARGET_IP:631/admin/ Target URL with variable IP, connecting to CUPS admin on port 631.
-iE Case-insensitive search using extended regular expressions.
'HTTP|www-authenticate|location' Regex pattern matching HTTP status, auth challenge, or redirect headers.

A 200 response on /admin/ without authentication is a critical finding — the admin interface is open. A 401 means auth is required but the interface is externally accessible. Move to CUPS admin interface testing.

Check cups-browsed Status

cups-browsed is the daemon vulnerable to CVE-2024-47176. Confirm it is running via UDP 631:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 631 $TARGET_IP 
631/udp open|filtered ipp
Explain command
-sU Performs a UDP scan instead of the default TCP scan.
-p 631 Scans only port 631 (IPP - Internet Printing Protocol).
$TARGET_IP Placeholder for the target host's IP address.

UDP 631 open or open|filtered alongside TCP 631 strongly suggests cups-browsed is active. This is the prerequisite for CVE-2024-47176 testing.

References