# IPP Printer and Queue Enumeration

- **URL:** https://hackindex.io/services/ipp-cups/enumeration/ipp-printer-and-queue-enumeration
- **Path:** IPP / CUPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ipp-cups/enumeration.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

IPP printer and queue enumeration retrieves printer attributes, queue names, and job history from CUPS and network printers without authentication. Printer attributes often include hostname, OS version, physical location, system uptime, and job accounting data. Queue names reveal internal department and user information. Print job history can contain document names, usernames, and submission timestamps that aid in mapping the target environment.

- List All Printers via CUPS Web Interface
- Dump Printer Attributes via IPP Protocol
- Enumerate via nmap ipp-info Per Queue
- List Print Jobs and Job History
- Enumerate System Information from CUPS

## List All Printers via CUPS Web Interface

```bash
curl -sk http://$TARGET_IP:631/printers/ | grep -oE 'href="/printers/[^"]+"' | sort -u
# href="/printers/HP_LaserJet"
# href="/printers/Finance_Printer"
# href="/printers/Executive_Floor"
```

Queue names like `Finance_Printer` and `Executive_Floor` reveal organizational structure and are useful context for social engineering and targeted attacks.

## Dump Printer Attributes via IPP Protocol

Use ipptool to send a Get-Printer-Attributes IPP request and dump all available attributes:

```bash
ipptool -t ipp://$TARGET_IP:631/printers/HP_LaserJet get-printer-attributes.test 2>/dev/null
```

```bash
# Query all attributes with curl sending raw IPP
curl -sk -X POST http://$TARGET_IP:631/printers/ \
  -H 'Content-Type: application/ipp' \
  -H 'Accept: application/ipp' | strings | grep -iE 'version|cups|printer|location|info|uri'
```

## Enumerate via nmap ipp-info Per Queue

```bash
nmap -p 631 $TARGET_IP --script ipp-info --script-args 'ipp-info.uri=ipp://$TARGET_IP:631/printers/HP_LaserJet'
# | ipp-info:
# |   printer-name: HP_LaserJet
# |   printer-location: 3rd Floor Server Room
# |   printer-info: Color LaserJet - Finance
# |   printer-make-and-model: HP Color LaserJet 5550
# |   printer-state: idle
# |   queued-job-count: 0
# |_  cups-version: 2.4.2
```

## List Print Jobs and Job History

CUPS exposes job history through the web interface. Job names often contain document titles and submitting usernames:

```bash
curl -sk http://$TARGET_IP:631/jobs/ | grep -iE 'job-name|job-originating-user|document'
```

```bash
curl -sk 'http://$TARGET_IP:631/jobs/?which_jobs=completed' | grep -iE 'title|href.*job'
# href="/jobs/12" title="Q4 Financial Report.pdf - john.smith"
```

Document names and usernames from job history are immediately useful: they confirm active users and reveal what kind of documents are being printed, which can indicate sensitive operations.

## Enumerate System Information from CUPS

The CUPS web interface leaks server hostname, OS, and uptime on the main page and admin pages:

```bash
curl -sk http://$TARGET_IP:631/ | grep -iE 'server|host|version|ubuntu|debian|redhat|centos'
# <p>CUPS 2.4.2 on ubuntu-server-01 (Linux 5.15.0-91-generic)</p>
```

The hostname and kernel version on the CUPS main page confirm the OS and kernel. Cross-reference the kernel version against local privilege escalation exploits.

## References

- [RFC 8011: Internet Printing Protocol](https://www.rfc-editor.org/rfc/rfc8011) - IPP Get-Printer-Attributes and Get-Jobs operation reference