Skip to content
HackIndex logo

HackIndex

Memcached Enumeration with libmemcached tools

2 min read Jun 19, 2026

If you want a cleaner operator workflow than raw nc, use libmemcached-tools. It wraps common operations, supports SASL options, and makes stats collection fast.

Quick stats with memcstat

┌──(kali㉿kali)-[~]
└─$ memcstat --servers=$TARGET_IP:${PORT:-11211}

Targeted stats you usually care about:

┌──(kali㉿kali)-[~]
└─$ memcstat --servers=$TARGET_IP:${PORT:-11211} -A "settings"
┌──(kali㉿kali)-[~]
└─$ memcstat --servers=$TARGET_IP:${PORT:-11211} -A "items"
┌──(kali㉿kali)-[~]
└─$ memcstat --servers=$TARGET_IP:${PORT:-11211} -A "slabs"

Interpretation:

  • settings tells you exposure and limits.

  • items and slabs tell you whether key dump techniques are likely to return anything useful.

Key enumeration with memcdump

┌──(kali㉿kali)-[~]
└─$ memcdump --servers=$TARGET_IP:${PORT:-11211} | head

Interpretation:

  • Expect incomplete results. Memcached does not guarantee a complete key listing via dump mechanisms.

  • If it returns nothing but the cache is clearly active, move to lru_crawler metadump or pull keys via application knowledge.

Fetch values with memccat

Once you have a key:

┌──(kali㉿kali)-[~]
└─$ memccat --servers=$TARGET_IP:${PORT:-11211} "some_key_name"

Use this when values are large or when you want clean output without VALUE wrappers.

Capability checks with memccapable

This is useful when you suspect protocol quirks, binary-only behavior, or proxies.

┌──(kali㉿kali)-[~]
└─$ memccapable -h $TARGET_IP -p ${PORT:-11211} -t 3

Interpretation:

  • If capability checks fail but the port is open, you might be dealing with TLS-wrapped memcached or access controls that require different client settings.

memcached-tool for slab overviews

memcached-tool is a long-lived stats script shipped in the memcached repository. Good for fast slab and item summaries.

┌──(kali㉿kali)-[~]
└─$ memcached-tool $TARGET_IP:${PORT:-11211} stats
┌──(kali㉿kali)-[~]
└─$ memcached-tool $TARGET_IP:${PORT:-11211} display

Metasploit convenience modules

┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use auxiliary/gather/memcached_extractor; set RHOSTS $TARGET_IP; set RPORT ${PORT:-11211}; run; exit"

What you expect:

  • If the instance allows reads and keys are discoverable, it will attempt to extract cached values.

  • If dumping is disabled, it usually returns minimal output and you should fall back to metadump or known-key reads.

References