Skip to content
HackIndex logo

HackIndex

Memcached SASL Authentication Detection

2 min read Feb 25, 2026

SASL changes your workflow: text protocol probing may fail, and the server may require binary protocol before it will answer anything useful.

Detect likely SASL or binary-only behavior

Start with a basic text probe:

┌──(kali㉿kali)-[~]
└─$ printf "version\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}

Signs you need a different approach:

  • Connection closes immediately without a VERSION.

  • You get only ERROR responses to basic text commands.

Confirm with memcstat using binary mode

If you have credentials:

┌──(kali㉿kali)-[~]
└─$ memcstat --servers=$TARGET_IP:${PORT:-11211} -b -u "$USER" -p "$PASSWORD" -S

If you do not have credentials yet, binary mode without auth can still confirm behavior:

┌──(kali㉿kali)-[~]
└─$ memcstat --servers=$TARGET_IP:${PORT:-11211} -b -S

Interpretation:

  • If -b works and text probing fails, you’re likely looking at SASL/binary-only configuration.

  • If -b works only with -u/-p, the service is enforcing authentication and you should pivot to credential sourcing elsewhere.

memcdump with SASL credentials

┌──(kali㉿kali)-[~]
└─$ memcdump --servers=$TARGET_IP:${PORT:-11211} -b -u "$USER" -p "$PASSWORD" | head

Use memccat to fetch specific keys once you have them.

References