Skip to content
HackIndex.io

IRC Enumeration

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

IRC (Internet Relay Chat) runs on port 6667 (plaintext) and 6697 (TLS). IRC servers in pentesting contexts are interesting for two reasons: backdoored versions of UnrealIRCd have a well-known RCE vulnerability, and IRC channels may contain sensitive information from automated bots posting credentials, alerts, or deployment notifications.

Port Scanning and Banner Grab

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 6667,6697 --script irc-info $TARGET_IP 
PORT     STATE SERVICE VERSION
6667/tcp open  irc     UnrealIRCd
| irc-info:
|   server: irc.target.local
|   version: Unreal3.2.8.1
|   servers: 1
|   users: 3
|   lservers: 0
|   lusers: 3
|_  source host: your-ip
Explain command
--script irc-info Extract server name, version, user count, and channel information.

Version is critical. UnrealIRCd 3.2.8.1 is the backdoored version. If found, proceed to exploitation immediately.

If the version shows UnrealIRCd 3.2.8.1, see UnrealIRCd backdoor exploitation for immediate RCE.

Manual Connection and Channel Enumeration

Connect with netcat and register a nickname to interact with the server. LIST shows all public channels with user counts:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 6667
┌──(kali㉿kali)-[~]
└─$ NICK testuser
┌──(kali㉿kali)-[~]
└─$ USER testuser 0 * :Test
┌──(kali㉿kali)-[~]
└─$ LIST 
:irc.target.local 322 testuser #general 3 :General discussion
:irc.target.local 322 testuser #ops 1 :Operations
:irc.target.local 323 testuser :End of /LIST

NICK and USER register your connection. LIST shows all public channels. Join interesting channels with JOIN #channel to read messages and look for credentials or operational info.

Channel Message Harvesting

After joining a channel, monitor for sensitive data. Automated bots often post deployment logs, credentials, API keys, and alert details to operations channels:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 6667
┌──(kali㉿kali)-[~]
└─$ NICK recon
┌──(kali㉿kali)-[~]
└─$ USER recon 0 * :Recon
┌──(kali㉿kali)-[~]
└─$ JOIN #ops
┌──(kali㉿kali)-[~]
└─$ JOIN #general

Stay connected and log output. Some channels require an invite or operator status. NAMES #channel lists users in a channel.

User and Operator Enumeration

IRC operators (ircops) have elevated server privileges. Identify them for potential social engineering or to understand the server administration structure:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 6667
┌──(kali㉿kali)-[~]
└─$ NICK enum
┌──(kali㉿kali)-[~]
└─$ USER enum 0 * :Enum
┌──(kali㉿kali)-[~]
└─$ WHOIS admin
┌──(kali㉿kali)-[~]
└─$ WHO *
┌──(kali㉿kali)-[~]
└─$ STATS o

WHOIS returns user details including channels and idle time. WHO * lists all visible users. STATS o shows configured IRC operators (requires some server configs to expose this).

Server Information and MOTD

The message of the day (MOTD) and server info commands may reveal hostnames, software versions, or admin contact details:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 6667
┌──(kali㉿kali)-[~]
└─$ NICK info
┌──(kali㉿kali)-[~]
└─$ USER info 0 * :Info
┌──(kali㉿kali)-[~]
└─$ MOTD
┌──(kali㉿kali)-[~]
└─$ ADMIN
┌──(kali㉿kali)-[~]
└─$ VERSION
┌──(kali㉿kali)-[~]
└─$ INFO

MOTD shows the server banner. ADMIN reveals admin email/name. VERSION confirms exact daemon version. INFO shows compile-time options and uptime.

References