IRC

IRC (Internet Relay Chat) is a text-based communication protocol used for real-time group and private messaging. It runs on TCP port 6667 for plaintext and TCP port 6697 for TLS-encrypted connections. Nmap identifies the service as irc. Common IRC server software includes UnrealIRCd, InspIRCd, and ngIRCd.

IRC servers have historically been used as command-and-control (C2) channels for botnets, making their presence on a network worth investigating. From a pentesting perspective, IRC services can expose user information, internal channel conversations, and server configuration details. Backdoored versions of IRC servers (notably UnrealIRCd 3.2.8.1 with a hardcoded backdoor) have provided trivial remote code execution. Weak or missing authentication on operator accounts and services (NickServ, ChanServ) are common findings.

Enumeration starts with connecting to the server and gathering version info via the VERSION command. Channel listing (LIST) reveals active channels and their topics. Nmap's irc-info script extracts server details, user count, and channel information. Testing for known backdoors, operator credential brute-forcing, and checking for information leakage in channel topics and MOTD messages are standard assessment steps.