Skip to content
HackIndex logo

HackIndex

IPP Printer and Queue Enumeration

4 min read Apr 4, 2026

IPP printer and queue enumeration retrieves printer attributes, queue names, and job history from CUPS and network printers without authentication. Printer attributes often include hostname, OS version, physical location, system uptime, and job accounting data. Queue names reveal internal department and user information. Print job history can contain document names, usernames, and submission timestamps that aid in mapping the target environment.

List All Printers via CUPS Web Interface

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:631/printers/ | grep -oE 'href="/printers/[^"]+"' | sort -u 
href="/printers/HP_LaserJet"
href="/printers/Finance_Printer"
href="/printers/Executive_Floor"
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL/TLS connections by skipping certificate verification.
http://$TARGET_IP:631/printers/ Target URL with variable IP hitting CUPS printer service on port 631.
-oE Enables extended regex and prints only the matching part of each line.
'href="/printers/[^"]+' Regex pattern to extract printer href attributes from HTML output.
-u Removes duplicate lines from sorted output, keeping unique entries only.

Queue names like Finance_Printer and Executive_Floor reveal organizational structure and are useful context for social engineering and targeted attacks.

Dump Printer Attributes via IPP Protocol

Use ipptool to send a Get-Printer-Attributes IPP request and dump all available attributes:

┌──(kali㉿kali)-[~]
└─$ ipptool -t ipp://$TARGET_IP:631/printers/HP_LaserJet get-printer-attributes.test 2>/dev/null
Explain command
-t Run the specified test file and report results.
ipp://$TARGET_IP:631/printers/HP_LaserJet Target IPP printer URI with IP, port 631, and printer name.
get-printer-attributes.test Test file requesting Get-Printer-Attributes IPP operation.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.
┌──(kali㉿kali)-[~]
└─$ # Query all attributes with curl sending raw IPP
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST http://$TARGET_IP:631/printers/ \
-H 'Content-Type: application/ipp' \
-H 'Accept: application/ipp' | strings | grep -iE 'version|cups|printer|location|info|uri'
Explain command
-s Silent mode; suppresses progress and error output.
-k Skip SSL/TLS certificate verification.
-X POST Force HTTP POST request method.
http://$TARGET_IP:631/printers/ Target IPP service endpoint on port 631.
-H 'Content-Type: application/ipp' Set request Content-Type header to IPP binary format.
-H 'Accept: application/ipp' Set Accept header expecting IPP binary response.
-iE Case-insensitive grep with extended regex pattern matching.
'version|cups|printer|location|info|uri' Regex pattern to filter IPP-relevant attribute keywords.

Enumerate via nmap ipp-info Per Queue

┌──(kali㉿kali)-[~]
└─$ nmap -p 631 $TARGET_IP --script ipp-info --script-args 'ipp-info.uri=ipp://$TARGET_IP:631/printers/HP_LaserJet' 
| ipp-info:
|   printer-name: HP_LaserJet
|   printer-location: 3rd Floor Server Room
|   printer-info: Color LaserJet - Finance
|   printer-make-and-model: HP Color LaserJet 5550
|   printer-state: idle
|   queued-job-count: 0
|_  cups-version: 2.4.2
Explain command
-p 631 Scan only port 631 (IPP - Internet Printing Protocol).
$TARGET_IP Placeholder for the target host IP address.
--script ipp-info Run the NSE script to enumerate IPP printer information.
--script-args 'ipp-info.uri=ipp://$TARGET_IP:631/printers/HP_LaserJet' Pass the IPP URI of the target printer to the ipp-info script.

List Print Jobs and Job History

CUPS exposes job history through the web interface. Job names often contain document titles and submitting usernames:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:631/jobs/ | grep -iE 'job-name|job-originating-user|document'
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections, skipping certificate verification.
http://$TARGET_IP:631/jobs/ Target URL hitting CUPS web interface jobs endpoint on port 631.
-iE Case-insensitive match using extended regular expressions.
'job-name|job-originating-user|document' Regex pattern to filter CUPS job metadata fields from output.
┌──(kali㉿kali)-[~]
└─$ curl -sk 'http://$TARGET_IP:631/jobs/?which_jobs=completed' | grep -iE 'title|href.*job' 
href="/jobs/12" title="Q4 Financial Report.pdf - john.smith"
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allows insecure SSL connections by skipping certificate verification.
http://$TARGET_IP:631/jobs/?which_jobs=completed Target CUPS web interface URL filtered to show completed print jobs.
-iE Case-insensitive matching with extended regex support.
'title|href.*job' Regex pattern to match HTML title tags or job-related href attributes.

Document names and usernames from job history are immediately useful — they confirm active users and reveal what kind of documents are being printed, which can indicate sensitive operations.

Enumerate System Information from CUPS

The CUPS web interface leaks server hostname, OS, and uptime on the main page and admin pages:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:631/ | grep -iE 'server|host|version|ubuntu|debian|redhat|centos' 
<p>CUPS 2.4.2 on ubuntu-server-01 (Linux 5.15.0-91-generic)</p>
Explain command
-s Silent mode; suppresses progress and error output.
-k Allows insecure TLS connections by skipping certificate verification.
http://$TARGET_IP:631/ Target URL using variable IP on port 631 (CUPS service).
-iE Case-insensitive search using extended regular expressions.
'server|host|version|ubuntu|debian|redhat|centos' Regex pattern to match OS/server version disclosure strings.

The hostname and kernel version on the CUPS main page confirm the OS and kernel. Cross-reference the kernel version against local privilege escalation exploits.

References