# IPP/CUPS Service Detection

- **URL:** https://hackindex.io/services/ipp-cups/enumeration/ipp-cups-service-detection
- **Path:** IPP / CUPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ipp-cups/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

IPP (Internet Printing Protocol) runs on port 631 and is implemented by CUPS on Linux/Unix systems and by many network printers directly. CUPS is the most common target: it runs a web administration interface on the same port that is often misconfigured to accept connections from any host. The CUPS RCE chain (CVE-2024-47176) disclosed in September 2024 made IPP a high-priority attack surface on any exposed Linux server. Always check port 631 during host enumeration on Linux targets.

- Port Detection
- NSE Script Enumeration
- CUPS Web Interface Check
- Check cups-browsed Status

## Port Detection

```bash
nmap -sV -p 631 $TARGET_IP
# 631/tcp open  ipp     CUPS 2.4.2
```

CUPS version from the banner is immediately useful: cross-reference against CVE-2024-47176 (affects CUPS before 2.4.11 / cups-browsed before 2.0.1) and older known vulnerabilities. A network printer speaking IPP will return a different banner: apply the printer enumeration methodology from [printer and queue enumeration](https://hackindex.io/services/ipp-cups/enumeration/ipp-printer-and-queue-enumeration).

## NSE Script Enumeration

```bash
nmap -p 631 $TARGET_IP --script ipp-info
# | ipp-info:
# |   printer-uri: ipp://10.10.10.50:631/printers/HP_LaserJet
# |   printer-name: HP_LaserJet
# |   printer-make-and-model: HP LaserJet 4050 Series
# |   printer-location: Server Room
# |   printer-info: Main printer
# |   cups-version: 2.4.2
# |_  ipp-versions-supported: 1.0 1.1 2.0
```

```bash
nmap -p 631 $TARGET_IP --script ipp-info,http-title,http-auth-finder
```

The printer-location field sometimes reveals physical location details useful for physical security assessment. The CUPS version in cups-version is the authoritative version string for CVE matching.

## CUPS Web Interface Check

CUPS hosts a web admin interface on port 631. Check accessibility and authentication requirements:

```bash
curl -sk http://$TARGET_IP:631/ | grep -iE 'title|cups|version'
# <title>Home - CUPS 2.4.2</title>
```

```bash
curl -skI http://$TARGET_IP:631/admin/ | grep -iE 'HTTP|www-authenticate|location'
# HTTP/1.1 401 Unauthorized
# WWW-Authenticate: Basic realm="CUPS"
```

A 200 response on `/admin/` without authentication is a critical finding: the admin interface is open. A 401 means auth is required but the interface is externally accessible. Move to [CUPS admin interface testing](https://hackindex.io/services/ipp-cups/vulnerability-discovery/cups-admin-interface-exposure).

## Check cups-browsed Status

cups-browsed is the daemon vulnerable to CVE-2024-47176. Confirm it is running via UDP 631:

```bash
sudo nmap -sU -p 631 $TARGET_IP
# 631/udp open|filtered ipp
```

UDP 631 open or open|filtered alongside TCP 631 strongly suggests cups-browsed is active. This is the prerequisite for [CVE-2024-47176 testing](https://hackindex.io/services/ipp-cups/vulnerability-discovery/cups-rce-cve-2024-47176).

## References

- [nmap: ipp-info NSE](https://nmap.org/nsedoc/scripts/ipp-info.html) - IPP printer attribute and CUPS version enumeration
- [CUPS](https://www.cups.org/) - CUPS documentation and version history