Skip to content
HackIndex.io

Memcached TLS Enumeration with openssl

3 min read Created Feb 25, 2026 Last updated Feb 25, 2026

Memcached on port 11211 normally communicates in plaintext. When a deployment wraps it in TLS, a raw nc connection returns no data or closes immediately. This looks identical to a filtered port. The actual service is alive but rejecting unencrypted input.

openssl s_client handles the TLS handshake and exposes the underlying plaintext protocol. Once the tunnel is up, memcached behaves exactly as it does without TLS. You pipe commands directly into the session and read responses as normal text.

Start with an Nmap probe to confirm TLS is present before attempting the connection.

Confirm TLS on the port

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p ${PORT:-11211} --script ssl-cert,ssl-enum-ciphers $TARGET_IP

The ssl-cert script outputs the certificate subject, issuer, validity dates, and SANs. Check the subject CN and any SAN entries against the host you are scanning. A self-signed certificate with a generic CN is common in internal deployments and does not indicate misconfiguration by itself. Note the expiry date; an expired certificate still allows the TLS handshake to complete.

ssl-enum-ciphers lists supported cipher suites with a letter grade. Weak grades (C or below) or the presence of SSLv3 or TLSv1.0 are worth flagging as findings. For enumeration purposes, the cipher grade does not block your access. Record the certificate details and move on to querying the service.

If ssl-cert returns nothing or the handshake fails, the port may be filtered at the TLS layer, or it may require a specific SNI value. Try adding -servername $TARGET_IP to the openssl s_client command to pass the SNI extension.

Send memcached commands over TLS

┌──(kali㉿kali)-[~]
└─$ printf "version\r\nstats\r\nquit\r\n" | openssl s_client -connect $TARGET_IP:${PORT:-11211} -quiet -ign_eof

What you expect:

  • A VERSION line if the backend speaks the text protocol.

  • STAT ... lines for stats.

The version response includes the exact server version string, for example VERSION 1.6.12. Knowing the version lets you cross-reference known CVEs. Versions before 1.5.13 predate the official TLS support addition. Seeing an older version number on a TLS port suggests a proxy or load balancer sits in front of the actual memcached process.

From the stats output, focus on a few key fields. STAT curr_items and STAT total_items show how actively the cache is used. High counts mean there is likely cached data worth retrieving. STAT auth_enabled_sasl 1 means SASL authentication is required for data operations; your unauthenticated stats request still returns, but get commands will fail until you authenticate. STAT uptime gives a rough sense of deployment stability and when the cache was last restarted.

Interpretation:

  • If TLS works but version returns ERROR, you may be talking to a proxy, a non-memcached service, or a SASL/binary-only deployment behind TLS.

When version returns ERROR, switch to binary protocol testing or verify the port is actually memcached rather than a different TLS service sharing the port. A proxy in front of memcached often passes the TLS handshake but does not forward text protocol commands to the backend.

References