# Memcached Enumeration with libmemcached tools

> Enumerate Memcached servers using libmemcached CLI tools to extract stats, dump cached keys, and retrieve stored values for reconnaissance.

- **URL:** https://hackindex.io/services/memcached/enumeration/memcached-enumeration-with-libmemcached-tools
- **Path:** Memcached > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/memcached/enumeration.md)
- **Published:** 2026-02-25
- **Updated:** 2026-06-19

If you want a cleaner operator workflow than raw `nc`, use `libmemcached-tools`. It wraps common operations, supports SASL options, and makes stats collection fast.

## Quick stats with memcstat

```bash
memcstat --servers=$TARGET_IP:${PORT:-11211}
```

Targeted stats you usually care about:

```bash
memcstat --servers=$TARGET_IP:${PORT:-11211} -A "settings"
memcstat --servers=$TARGET_IP:${PORT:-11211} -A "items"
memcstat --servers=$TARGET_IP:${PORT:-11211} -A "slabs"
```

Interpretation:

- `settings` tells you exposure and limits.
- `items` and `slabs` tell you whether key dump techniques are likely to return anything useful.

## Key enumeration with memcdump

```bash
memcdump --servers=$TARGET_IP:${PORT:-11211} | head
```

Interpretation:

- Expect incomplete results. Memcached does not guarantee a complete key listing via dump mechanisms.
- If it returns nothing but the cache is clearly active, move to `lru_crawler metadump` or pull keys via application knowledge.

## Fetch values with memccat

Once you have a key:

```bash
memccat --servers=$TARGET_IP:${PORT:-11211} "some_key_name"
```

Use this when values are large or when you want clean output without `VALUE` wrappers.

## Capability checks with memccapable

This is useful when you suspect protocol quirks, binary-only behavior, or proxies.

```bash
memccapable -h $TARGET_IP -p ${PORT:-11211} -t 3
```

Interpretation:

- If capability checks fail but the port is open, you might be dealing with TLS-wrapped memcached or access controls that require different client settings.

## memcached-tool for slab overviews

`memcached-tool` is a long-lived stats script shipped in the memcached repository. Good for fast slab and item summaries.

```bash
memcached-tool $TARGET_IP:${PORT:-11211} stats
memcached-tool $TARGET_IP:${PORT:-11211} display
```

## Metasploit convenience modules

> [!CAUTION]
> This may be restricted in exams such as OSCP. Metasploit modules are limited to one machine per exam. The manual enumeration above does not need Metasploit.

```bash
msfconsole -q -x "use auxiliary/gather/memcached_extractor; set RHOSTS $TARGET_IP; set RPORT ${PORT:-11211}; run; exit"
```

What you expect:

- If the instance allows reads and keys are discoverable, it will attempt to extract cached values.
- If dumping is disabled, it usually returns minimal output and you should fall back to metadump or known-key reads.

## References

- [https://manpages.debian.org/experimental/libmemcached-tools/memcstat.1.en.html](https://manpages.debian.org/experimental/libmemcached-tools/memcstat.1.en.html) - memcstat options including binary mode and SASL flags.
- [https://manpages.debian.org/experimental/libmemcached-tools/memcdump.1.en.html](https://manpages.debian.org/experimental/libmemcached-tools/memcdump.1.en.html) - memcdump behavior and key dump limitations.
- [https://manpages.debian.org/unstable/libmemcached-tools/memccapable.1.en.html](https://manpages.debian.org/unstable/libmemcached-tools/memccapable.1.en.html) - memccapable purpose and usage.
- [https://github.com/bureado/libmemcached/blob/master/debian/libmemcached-tools.README.Debian](https://github.com/bureado/libmemcached/blob/master/debian/libmemcached-tools.README.Debian) - tool naming conventions mem* vs memc*.
- [https://github.com/memcached/memcached/blob/master/scripts/memcached-tool](https://github.com/memcached/memcached/blob/master/scripts/memcached-tool) - memcached-tool script source.
- [https://man.archlinux.org/man/extra/memcached/memcached-tool.1.en](https://man.archlinux.org/man/extra/memcached/memcached-tool.1.en) - memcached-tool modes and usage.