Skip to content
HackIndex logo

HackIndex

Memcached TLS Enumeration with openssl

1 min read Feb 25, 2026

If memcached is TLS-wrapped, normal nc probing looks like a dead service. Use openssl s_client to establish the tunnel, then run the same text protocol commands.

Confirm TLS on the port

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p ${PORT:-11211} --script ssl-cert,ssl-enum-ciphers $TARGET_IP

If ssl-cert returns a certificate, treat it as TLS-wrapped traffic on that port.

Send memcached commands over TLS

┌──(kali㉿kali)-[~]
└─$ printf "version\r\nstats\r\nquit\r\n" | openssl s_client -connect $TARGET_IP:${PORT:-11211} -quiet -ign_eof

What you expect:

  • A VERSION line if the backend speaks the text protocol.

  • STAT ... lines for stats.

Interpretation:

  • If TLS works but version returns ERROR, you may be talking to a proxy, a non-memcached service, or a SASL/binary-only deployment behind TLS.

References