Inspect Redis access and persistence boundaries

Needs: Reachability and accepted authentication/ACL commands; persistence writes need CONFIG rights, destination permissions and a consumer

Shell commands

# Baseline
nmap -Pn -sV --script redis-info -p PORT TARGET
redis-cli -h TARGET -p PORT PING
redis-cli -h TARGET -p PORT INFO
redis-cli -h TARGET -p PORT ACL WHOAMI
redis-cli -h TARGET -p PORT ACL LIST

# Authenticated when a password is legitimately known
redis-cli -h TARGET -p PORT --askpass

PONG proves an accessible Redis command surface, not write/file/execution permission. Check ACLs, mode, bind/protected-mode and persistence/module configuration before reasoning about an effect. Do not run CONFIG SET, write keys or load modules during enumeration.

Verify → Verify authentication context, allowed commands and actual key/file effects without assuming old Redis exploit defaults.

If it fails → NOAUTH and NOPERM identify different boundaries. Investigate credentials or permitted data rather than assuming unauthenticated execution. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
Administrative actions/routes or request methods visible from a lower role → Cross role, function or session authorization boundaries
Needs: The lower-role identity can invoke a protected server-side action without its required authorization
A product/version clue, advisory or component-specific public PoC → Match a public exploit to the actual component and configuration
Needs: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Inspect Redis access and persistence boundaries

USE WHEN: A Redis listener or application cache credentials
STARTING ACCESS: A confirmed reachable application; anonymous context or one identified credential
RESULT: Useful accessible keys or a precisely bounded persistence/file-write candidate

Recognize the clue

Identify Redis and use its authentication context to distinguish accepted commands from denied administrative facilities.

redis-cli -h TARGET -p PORT PING

SYNTHETIC EXAMPLE OUTPUT

PONG
Administrative operation: NOPERM this user has no permissions

Means: The connection is usable but command ACLs can remove persistence/configuration methods.

Confirm: Inspect allowed operations, data visibility and actual persistence/destination/consumer conditions.

After validation: Useful keys are readable or a fully permitted file-consumer chain exists: select that bounded capability.
Ruled out in this context: CONFIG denied rules out the familiar configuration-backed file-write route under this identity.
Still inconclusive: PING alone leaves key and administrative rights unknown; inspect the selected permitted command.

Troubleshooting: NOAUTH and NOPERM identify different boundaries. Investigate credentials or permitted data rather than assuming unauthenticated execution.

Authenticated when a password is legitimately known:

PONG proves an accessible Redis command surface, not write/file/execution permission. Check ACLs, mode, bind/protected-mode and persistence/module configuration before reasoning about an effect. Do not run CONFIG SET, write keys or load modules during enumeration.

Why it works

Redis keys may disclose sessions or secrets. Historical file-write chains depend on command permissions, persistence format and a writable useful path; an open port alone proves none of them.

Worked example · hypothetical

Observation: PING returns PONG but CONFIG is denied. Test: inspect allowed data access. Illustrative output: only application keys are readable. Interpretation: investigate session/credential value while rejecting a presumed arbitrary-file-write chain.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗