# Memcached SASL Authentication Detection

- **URL:** https://hackindex.io/services/memcached/enumeration/memcached-sasl-auth-detection-and-enumeration
- **Path:** Memcached > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/memcached/enumeration.md)
- **Published:** 2026-02-25
- **Updated:** 2026-02-25

SASL changes your workflow. Text protocol probing may fail, and the server may require binary protocol before it will answer anything useful.

Memcached with SASL enabled runs exclusively over its binary protocol. Any text-mode client, including raw netcat, will see no useful response or an immediate connection drop. Most default enumeration scripts use the text protocol. On a SASL instance, this makes the service look like a dead port. Identify this early before wasting time on firewall rules that do not exist.

## Detect memcached SASL auth or binary-only behavior

Start with a basic text probe:

```bash
printf "version\r\nquit\r\n" | nc -nv -w 3 $TARGET_IP ${PORT:-11211}
```

Signs you need a different approach:

- Connection closes immediately without a `VERSION`.
- You get only `ERROR` responses to basic text commands.

A clean `VERSION` banner rules out SASL. If the connection drops without printing anything, the server is likely running binary-only mode. If you get `ERROR` back, the server received your command and rejected it as invalid protocol. Either way, switch to binary protocol tools before drawing any conclusions.

memcstat ships with libmemcached-tools on Debian and Kali. Install it with `apt install libmemcached-tools` if the command is not found.

## Confirm with memcstat using binary mode

If you have credentials:

```bash
memcstat --servers=$TARGET_IP:${PORT:-11211} -b -u "$USER" -p "$PASSWORD" -S
```

If you do not have credentials yet, binary mode without authentication can still confirm behavior. A SASL-enforced server will reject the connection at the authentication step rather than returning stats. This tells you authentication is enforced and credentials are required before any data is accessible. Note the error output carefully: a refused binary connection differs from a timeout or a firewall drop. Timeouts suggest filtering. An explicit authentication error confirms the service is live and SASL is active.

```bash
memcstat --servers=$TARGET_IP:${PORT:-11211} -b -S
```

Interpretation:

- If `-b` works and text probing fails, you're likely looking at SASL/binary-only configuration. The service is accessible, just not through text-mode clients. Proceed with binary-capable tools.
- If `-b` works only with `-u/-p`, the service is enforcing authentication and you should pivot to credential sourcing elsewhere.

When authentication is enforced, look for credentials in application config files, environment variables, and container secrets. PHP, Node.js, and Python applications often store the memcached password in plaintext inside a `.env` or config file. Check web roots, deployment scripts, and any configuration files in scope. Once you have valid credentials, memcdump lists every key the server holds.

## memcdump with SASL credentials

```bash
memcdump --servers=$TARGET_IP:${PORT:-11211} -b -u "$USER" -p "$PASSWORD" | head
```

Use `memccat` to fetch specific keys once you have them. Key names from memcdump can reveal their purpose. Session IDs, user tokens, cached query results, and serialized objects all appear regularly. Look for anything referencing `auth`, `session`, `token`, or `user` in the key name. Serialized PHP or Python objects may contain credentials or authorization data that the application trusts without re-validating. Treat every key as potentially sensitive until inspected.

> [!WARNING]
> The memcached binary protocol is considered deprecated upstream, but SASL deployments still rely on it in real environments. Treat this as a client-compatibility problem, not a reason to stop.

If memcstat returns connection refused, the port may be filtered or the service is not running. Verify with a basic TCP connect before assuming SASL is the issue. Some deployments run memcached on a non-standard port. Check for services on 11211 and 11212, and any custom ports referenced in application configs or source code. Empty memcdump output with valid credentials can mean the cache is empty. The account may also only have access to a subset of keys. Try fetching a key directly with `memccat` to confirm read access works.

## References

- [https://github.com/memcached/memcached/wiki/SASLHowto](https://github.com/memcached/memcached/wiki/SASLHowto) - memcached -S enables SASL and requires binary protocol.
- [https://manpages.debian.org/experimental/libmemcached-tools/memcstat.1.en.html](https://manpages.debian.org/experimental/libmemcached-tools/memcstat.1.en.html) - memcstat binary and SASL flags (-b, -u, -p).
- [https://docs.memcached.org/protocols/](https://docs.memcached.org/protocols/) - protocol overview noting binary protocol deprecation.