Skip to content
HackIndex.io
Redis
Service

Redis

Redis in-memory store tested for unauth access, version flaws, and keyspace secrets. Exploits include RCE via file writes, SSH key injection, cron abuse, auth bypass, and SSRF for lateral movement

:6379 12 guides 4 phases
1 min read Created: Dec 28, 2025 Updated: Jul 13, 2026

Redis is an in-memory key-value data store running on TCP port 6379. Nmap identifies it as redis. Redis is used for caching, session storage, message queues, and as a lightweight database in web application stacks.

Redis has no authentication enabled by default. An unauthenticated instance allows full read and write access to all stored data, which may include session tokens, cached credentials, and application secrets. Redis can also write arbitrary files to disk using the CONFIG SET dir and CONFIG SET dbfilename commands, enabling SSH key injection, crontab modification, or webshell placement.

Connect with redis-cli and run INFO to check the server version, OS, and configuration. Enumerate keys with KEYS * and inspect their contents. Test file write capabilities through CONFIG SET. If authentication is enabled, try common passwords or brute-force with hydra. Nmap's redis-info script handles initial enumeration.

Enumeration

Redis auth, version, keyspace, and secrets via nmap and redis-cli

1
Redis enumeration with nmap and redis-cli

Redis enumeration with nmap and redis-cli

Enumerate Redis instances using Nmap scripts and redis-cli to extract server info, config, keys, and identify misconfigurations like unauthenticated access.

Jan 18, 2026 • 4 min read

Exploitation

RCE, auth bypass, SSRF, and shell writes against Redis

9
Redis Master-Slave Replication RCE

Redis Master-Slave Replication RCE

Exploiting Redis master-slave replication to achieve RCE by loading a malicious module via the SLAVEOF command on exposed instances.

Mar 14, 2026 • 4 min read

Redis RCE via Malicious Module Load

Exploit unauthenticated or authenticated Redis instances by loading a malicious .so module to achieve remote code execution on the target system.

Mar 14, 2026 • 4 min read
Redis RCE via SSH Key Injection

Redis RCE via SSH Key Injection

Exploit unauthenticated Redis instances to achieve RCE by injecting attacker-controlled SSH public keys into root's authorized_keys via Redis config manipulation.

Mar 14, 2026 • 4 min read

Privilege Escalation

Escalate via Redis file writes to SUID, SSH keys, or cron paths

1

Persistence

Write SSH keys, cron jobs, or webshells via Redis config

1

Redis Persistence via CONFIG SET

Abuses Redis CONFIG SET to redirect DB dumps or AOF logs to attacker-controlled paths, achieving filesystem writes and persistent backdoor placement.

May 6, 2026 • 5 min read