Vulnerability Discovery

Rsync vulnerability discovery checks for anonymous access and misconfigured module permissions. Connect to the rsync daemon on port 873 and list modules: any module that returns content without prompting for credentials is an anonymous access finding. Check both read and write permissions separately since they are configured independently.

Review what each module exposes. A module pointing at / or /etc/ gives full filesystem read access. Backup modules often mirror entire systems including shadow files, SSH keys, and database credentials. Even seemingly harmless modules may contain sensitive data in configuration files or application directories.

Missing authentication on modules is the primary vulnerability. Beyond that, check for modules with write access to sensitive paths, rsync running as root (meaning file operations happen with root permissions), and unencrypted rsync without SSH tunneling on untrusted networks. The rsyncd.conf file, if accessible, reveals all module definitions including those hidden from the listing with list = false.