# Rsync

> File sync daemon

- **URL:** https://hackindex.io/services/rsync
- **Type:** Service
- **Default ports:** 873
- **Tags:** rsync, file-transfer, linux, daemon, network, sync
- **Published:** 2026-01-26
- **Updated:** 2026-07-13

Rsync is a file synchronization and transfer utility commonly used for backups, mirroring, and file distribution. When running as a daemon, it listens on **TCP port 873**. Nmap identifies the service as `rsync`.

An exposed rsync daemon can be a significant finding. When modules (shared directories) are configured without authentication, anyone can list available modules and download their contents. This frequently exposes backup files, configuration data, source code, credentials, and database dumps. Writable modules allow an attacker to upload files, which can lead to code execution if the synced directory is served by a web server or processed by an application.

Enumeration begins with listing available modules using `rsync --list-only rsync://target:873/`. Each module can then be explored for accessible files. Nmap's `rsync-list-modules` script automates the initial discovery. Testing for anonymous read and write access on each module, checking for sensitive files in exposed backups, and attempting credential brute-force on authenticated modules are the standard assessment steps.

## Phases

- [Enumeration](https://hackindex.io/services/rsync/enumeration.md): List modules, check access, and pull high-value directories (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/rsync/vulnerability-discovery.md): Guides on finding open rsync shares with no auth required (1 guides)
- [Exploitation](https://hackindex.io/services/rsync/exploitation.md): Pull files and upload backdoors via open or writable rsync modules (2 guides)