# rsync module enumeration

- **URL:** https://hackindex.io/services/rsync/enumeration/rsync-module-enumeration
- **Path:** Rsync > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/rsync/enumeration.md)
- **Published:** 2026-01-26
- **Updated:** 2026-08-12

Rsync daemon mode exposes named modules: each a configured directory path with its own access controls. Module enumeration lists what is available and whether authentication is required. Unauthenticated read access means arbitrary file download from that path. Unauthenticated write access means file planting. Both are high-impact findings. This page covers discovery and access validation: exploitation is covered in [file access and loot](https://hackindex.io/services/rsync/exploitation/rsync-file-access-and-loot) and [write access exploitation](https://hackindex.io/services/rsync/exploitation/rsync-write-access-exploitation).

- Service Detection
- List Modules: nmap NSE
- List Modules: rsync Client
- Check Read Access Per Module
- Check Write Access
- Authenticated Module Access
- Credential Bruteforce

## Service Detection

```bash
nmap -sV -p 873 $TARGET_IP
# 873/tcp open  rsync   (protocol version 31)
```

## List Modules: nmap NSE

```bash
nmap -p 873 --script rsync-list-modules $TARGET_IP
# | rsync-list-modules:
# |   public          Public files
# |   backup          Nightly backups
# |_  www             Web root
```

## List Modules: rsync Client

Faster and works without nmap. Use this for all follow-on operations too:

```bash
rsync --list-only rsync://$TARGET_IP:873/
# public          Public files
# backup          Nightly backups
# www             Web root
```

If listing returns modules, check read access on each immediately. If listing is denied with an error like `@ ERROR: auth failed to connect` or `@ ERROR: Unknown module`, the daemon requires authentication or does not expose the module list anonymously.

## Check Read Access Per Module

List the contents of each discovered module without downloading. Size and file count give you a quick sense of what is inside before pulling:

```bash
rsync --list-only rsync://$TARGET_IP:873/backup/
# drwxr-xr-x          4,096 2026/03/28 12:00:00 .
# drwxr-xr-x          4,096 2026/03/01 08:00:00 configs
# -rw-r--r--         81,920 2026/03/01 08:00:00 db_dump.sql
# -rw-r--r--          2,048 2026/03/01 08:00:00 .env
```

```bash
rsync --list-only rsync://$TARGET_IP:873/www/
```

A .env file and db_dump.sql in the backup module are immediate high-value targets. Pull those specific files rather than the whole module when disk space or speed matters.

## Check Write Access

Confirm whether the module accepts uploads by attempting to sync a test file:

```bash
echo 'write_test' > /tmp/rsync_writetest.txt
rsync /tmp/rsync_writetest.txt rsync://$TARGET_IP:873/www/ 2>&1
# @ ERROR: module is read only
# rsync error: error starting client-server protocol (code 5) at main.c(1649) [sender=3.1.3]
```

```bash
echo 'write_test' > /tmp/rsync_writetest.txt
rsync -v /tmp/rsync_writetest.txt rsync://$TARGET_IP:873/www/rsync_writetest.txt 2>&1
# rsync_writetest.txt
#
# sent 74 bytes  received 35 bytes  218.00 bytes/sec
# total size is 10  speedup is 0.09
```

A successful sync without errors confirms write access. Clean up the test file immediately and move to [write access exploitation](https://hackindex.io/services/rsync/exploitation/rsync-write-access-exploitation). If the server returns `@ ERROR: read only`, the module is read-only: move to [file access and loot](https://hackindex.io/services/rsync/exploitation/rsync-file-access-and-loot) instead.

## Authenticated Module Access

When a module requires credentials: indicated by an `@ ERROR: auth failed` response: provide them via the URL:

```bash
rsync --list-only rsync://$USER@$TARGET_IP:873/backup/ 2>&1
# Password:
# (enter password when prompted)
```

```bash
RSYNC_PASSWORD=$PASSWORD rsync --list-only rsync://$USER@$TARGET_IP:873/backup/
```

## Credential Bruteforce

> [!CAUTION]
> Bruteforcing may violate exam or engagement rules. Only use when explicitly authorized and the module name is already known.

```bash
nmap -p 873 --script rsync-brute --script-args 'rsync-brute.module=backup' $TARGET_IP
```

## References

- [nmap: rsync-list-modules NSE](https://nmap.org/nsedoc/scripts/rsync-list-modules.html) - Lists available rsync modules with descriptions
- [rsync(1) manual](https://man7.org/linux/man-pages/man1/rsync.1.html) - Daemon mode URL format and --list-only behavior
- [rsyncd.conf(5)](https://download.samba.org/pub/rsync/rsyncd.conf.5) - Module access control configuration including read only and auth settings