Memcached

Memcached is a high-performance, distributed in-memory key-value cache used to speed up web applications by caching database queries, API responses, and session data. It listens on TCP and UDP port 11211. Nmap identifies it as memcache.

Memcached has no built-in authentication or encryption. Any client that can reach port 11211 can read and write cached data. Exposed instances frequently leak session tokens, user credentials, application secrets, and database query results. The UDP protocol support has been exploited in massive DDoS amplification attacks, where a small spoofed request generates a disproportionately large response aimed at the victim.

Enumeration involves connecting via telnet or netcat and running stats to retrieve server information, then stats items and stats cachedump to list and dump cached keys. Tools like memcdump and memccat from libmemcached automate extraction. Cached data often contains serialized objects that can be manipulated for deserialization attacks when written back.