Skip to content
HackIndex logo

HackIndex

Enumeration with Nmap and Text

3 min read Feb 25, 2026

Memcached is usually wide open internally. Your first job is to confirm you can talk to it, fingerprint version and features, then pull stats that tell you whether key dumping is possible and whether the instance is worth deeper work.

Nmap discovery and fingerprinting

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p ${PORT:-11211} --script memcached-info $TARGET_IP 
11211/udp open  unknown
| memcached-info:
|   Process ID: 18568
|   Uptime: 6950 seconds
|   Server time: 2018-03-02T03:35:09
|   Architecture: 64 bit
|   Used CPU (user): 0.172010
|   Used CPU (system): 0.200012
|   Current connections: 10
|   Total connections: 78
|   Maximum connections: 1024
|   TCP Port: 11211
|   UDP Port: 11211
|_  Authentication: no

Raw connection sanity check

Use CRLF. If you send only \n, you will get inconsistent behavior.

┌──(kali㉿kali)-[~]
└─$ printf "version\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211} 
VERSION 1.6.22

Interpretation that matters:

  • If you get a VERSION, the text protocol is reachable.

  • If the connection closes or you get only ERROR, consider TLS-wrapped memcached or SASL/binary-only deployments. See the SASL/TLS pages.

High-signal stats pulls

Global stats

┌──(kali㉿kali)-[~]
└─$ printf "stats\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

What to look for:

  • version for fingerprinting.

  • curr_items and bytes to decide if this cache is active and worth key work.

  • cmd_get, cmd_set, get_hits, get_misses to confirm real application traffic.

Settings that change your options

┌──(kali㉿kali)-[~]
└─$ printf "stats settings\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

What to look for:

  • maxbytes, maxconns, tcpport, udpport for exposure and capacity clues.

  • If dumping commands are disabled server-side, your key-dump techniques will fail even if the service is reachable.

Item and slab overview

┌──(kali㉿kali)-[~]
└─$ printf "stats items\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211} 
STAT items:1:number 42
STAT items:2:number 3

How you use it:

  • The slab IDs drive legacy stats cachedump enumeration.

  • A spread across many slabs usually means mixed key sizes and a busy cache.

┌──(kali㉿kali)-[~]
└─$ printf "stats slabs\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

How you use it:

  • Confirms which slab classes are active and how memory is distributed.

  • Useful for deciding which slabs to target first when doing legacy dumps.

Safe read/write validation

You want to know if you can write keys (cache poisoning risk) without being destructive. Use a short TTL and a unique key name.

┌──(kali㉿kali)-[~]
└─$ printf "set hx_probe 0 5 4\r\ntest\r\nget hx_probe\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

Interpretation:

  • If STORED and the get returns your value, the instance is writable from your position.

  • Next move is usually application mapping: identify what the target app stores in memcached and whether keys are guessable or dumpable.

References