Skip to content
HackIndex logo

HackIndex

Memcached UDP Exposure Checks

1 min read Feb 25, 2026

UDP exposure is a security issue even when you do not plan to abuse it. Your goal is to confirm whether UDP is enabled and reachable, then report it with proof.

Detect UDP reachability

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p ${PORT:-11211} $TARGET_IP

Interpretation:

  • open|filtered is common on UDP. You still need an application-level probe to confirm responses.

Application-level UDP probe

Use a short timeout and a low-noise payload. version is usually enough.

┌──(kali㉿kali)-[~]
└─$ printf "version\r\n" | nc -u -nv -w 2 $TARGET_IP ${PORT:-11211}

If it responds, you will typically see a VERSION ... line.

What to do with a positive hit

  • Report UDP exposure as a high-risk misconfiguration.

  • Confirm whether UDP is expected in this environment. Modern hardening often disables it.

Notes that affect interpretation:

  • Many current packages ship with UDP off by default, but older builds and custom configs may still expose it.

  • Even if UDP is off, document that you validated it.

References