Skip to content
HackIndex.io

Zabbix Enumeration

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

Zabbix is a monitoring platform with a web frontend (port 80/443), a server (port 10051), and agents (port 10050). The web interface often has default credentials, and the agent protocol allows command execution when misconfigured. Enumeration focuses on identifying the version, testing default credentials, and checking agent accessibility.

Web Interface Detection

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP/zabbix/ -o /dev/null -w '%{http_code}' 
200

Common paths: /zabbix/, / (root), /zabbix/index.php. A 200 response with a Zabbix login page confirms the web frontend.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP/zabbix/ | grep -oP 'Zabbix [0-9]+\.[0-9]+\.[0-9]+' 
Zabbix 6.0.21

Default Credentials

Zabbix ships with default admin credentials. Test them against the web interface.

┌──(kali㉿kali)-[~]
└─$ curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
-H 'Content-Type: application/json-rpc' \
-d '{"jsonrpc":"2.0","method":"user.login","params":{"user":"Admin","password":"zabbix"},"id":1}' 
{"jsonrpc":"2.0","result":"a1b2c3d4e5f6g7h8i9j0","id":1}

A "result" field with a session token means login succeeded. Default credentials: Admin:zabbix (case-sensitive username). Other common: guest:'' (empty password, if guest access is enabled).

The guest account is disabled by default since Zabbix 6.0 but may be enabled on older installations.

API Enumeration

With a valid session token, enumerate hosts, users, and configuration through the JSON-RPC API.

┌──(kali㉿kali)-[~]
└─$ curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
-H 'Content-Type: application/json-rpc' \
-d '{"jsonrpc":"2.0","method":"host.get","params":{"output":["hostid","host","name","status"],"selectInterfaces":["ip","port"]},"auth":"<SESSION_TOKEN>","id":2}'

Returns all monitored hosts with their internal IPs and agent ports. Replace <SESSION_TOKEN> with the token from the login response.

┌──(kali㉿kali)-[~]
└─$ curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
-H 'Content-Type: application/json-rpc' \
-d '{"jsonrpc":"2.0","method":"user.get","params":{"output":["userid","username","name","surname","type"]},"auth":"<SESSION_TOKEN>","id":3}'

User type 3 = Super admin, 2 = Admin, 1 = User. Knowing usernames helps with password spraying.

Agent Port Scanning

Zabbix agents listen on port 10050. If the agent is configured to accept commands from any host (not just the Zabbix server), it can be exploited for RCE.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 10050,10051 $TARGET_IP 
PORT      STATE SERVICE    VERSION
10050/tcp open  zabbix-agent Zabbix Agent
10051/tcp open  zabbix-trapper Zabbix Trapper

Port 10050 (agent) accepts check requests. Port 10051 (trapper) accepts data submissions. Both can be exploited depending on configuration.

┌──(kali㉿kali)-[~]
└─$ echo 'system.hostname' | nc -w 3 $TARGET_IP 10050 
ZBXD\x01web-server-01

A hostname response confirms the agent accepts connections. If system.run is enabled, this leads to RCE.

If default credentials work or agent access is confirmed, continue to Zabbix agent RCE for command execution.

References