# IRC Enumeration

> Techniques for enumerating IRC services, extracting server info, channels, users, and configurations using tools like Nmap, netcat, and IRC clients.

- **URL:** https://hackindex.io/services/irc/enumeration/irc-enumeration
- **Path:** IRC > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/irc/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

IRC (Internet Relay Chat) runs on port 6667 (plaintext) and 6697 (TLS). IRC servers in pentesting contexts are interesting for two reasons: backdoored versions of UnrealIRCd have a well-known RCE vulnerability, and IRC channels may contain sensitive information from automated bots posting credentials, alerts, or deployment notifications.

## Port Scanning and Banner Grab

```bash
nmap -sV -p 6667,6697 --script irc-info $TARGET_IP
# PORT     STATE SERVICE VERSION
# 6667/tcp open  irc     UnrealIRCd
# | irc-info:
# |   server: irc.target.local
# |   version: Unreal3.2.8.1
# |   servers: 1
# |   users: 3
# |   lservers: 0
# |   lusers: 3
# |_  source host: your-ip
```

If the version shows UnrealIRCd 3.2.8.1, see [UnrealIRCd backdoor exploitation](https://hackindex.io/services/irc/exploitation/unrealircd-backdoor-exploitation) for immediate RCE.

## Manual Connection and Channel Enumeration

Connect with netcat and register a nickname to interact with the server. LIST shows all public channels with user counts:

```bash
nc $TARGET_IP 6667
NICK testuser
USER testuser 0 * :Test
LIST
# :irc.target.local 322 testuser #general 3 :General discussion
# :irc.target.local 322 testuser #ops 1 :Operations
# :irc.target.local 323 testuser :End of /LIST
```

## Channel Message Harvesting

After joining a channel, monitor for sensitive data. Automated bots often post deployment logs, credentials, API keys, and alert details to operations channels:

```bash
nc $TARGET_IP 6667
NICK recon
USER recon 0 * :Recon
JOIN #ops
JOIN #general
```

## User and Operator Enumeration

IRC operators (ircops) have elevated server privileges. Identify them for potential social engineering or to understand the server administration structure:

```bash
nc $TARGET_IP 6667
NICK enum
USER enum 0 * :Enum
WHOIS admin
WHO *
STATS o
```

## Server Information and MOTD

The message of the day (MOTD) and server info commands may reveal hostnames, software versions, or admin contact details:

```bash
nc $TARGET_IP 6667
NICK info
USER info 0 * :Info
MOTD
ADMIN
VERSION
INFO
```

## References

- [Nmap: irc-info NSE Script](https://nmap.org/nsedoc/scripts/irc-info.html) - IRC server information gathering via NSE
- [RFC 2812: Internet Relay Chat Client Protocol](https://datatracker.ietf.org/doc/html/rfc2812) - IRC client protocol specification covering WHOIS, WHO, LIST, and other enumeration commands