9.2.13 Memcached and WebDAV

9.2.13.1 Memcached — inspect cache data through TCP

Use when a listener identifies as Memcached, commonly TCP/11211. Start with the text protocol; do not confuse cache access with an OS shell.

9.2.13.1.1 Identify the service and inspect its counters

# Identify the service and inspect its counters
printf 'version\r\nstats\r\nquit\r\n' | nc -nv TARGET PORT

9.2.13.1.2 Discover available slab/key metadata, if these commands are enabled

# Discover available slab/key metadata, if these commands are enabled
printf 'stats items\r\nlru_crawler metadump all\r\nquit\r\n' | nc -nv TARGET PORT

9.2.13.1.3 Read one key learned from configuration or metadata

# Read one key learned from configuration or metadata
printf 'get KEY\r\nquit\r\n' | nc -nv TARGET PORT

Read: VALUE KEY ... followed by content proves a readable item; END alone does not establish that every key is absent. Configuration, session data or account material → identify its application/account and test that context. ERROR can mean unsupported or disabled metadata commands. Authentication/TLS or a binary-only interface requires its matching client. UDP amplification recipes are not part of this workflow.

Sources: upstream 1.

9.2.13.2 WebDAV — list, retrieve and test the actual write boundary

Use when OPTIONS advertises DAV/PROPFIND or a known DAV endpoint exists. Preserve the real hostname and authentication.

9.2.13.2.1 curl -i -X OPTIONS http://TARGET:PORT/PATH/

curl -i -X OPTIONS http://TARGET:PORT/PATH/
curl -i -X PROPFIND -H 'Depth: 1' http://TARGET:PORT/PATH/

9.2.13.2.2 Known-account version; curl prompts for the password

# Known-account version; curl prompts for the password
curl -i -u USER -X PROPFIND -H 'Depth: 1' http://TARGET:PORT/PATH/

9.2.13.2.3 Interactive client; respond to the authentication prompt if required

# Interactive client; respond to the authentication prompt if required
cadaver http://TARGET:PORT/PATH/

In cadaver, choose the relevant operation:

ls
get FILE
put probe.txt
delete probe.txt
quit

Read: a 207 response needs actual resource entries; a 401/login page is not a listing. Readable source/config → credentials or application mapping. A successful write → retrieve that exact file and check its handler/privileged consumer. DAV write access by itself is not code execution. Use a harmless uniquely named probe and remove it after validation.

Sources: upstream 1 · upstream 2.