| name | ident-pentesting |
| description | Pentest the Ident Protocol (port 113) to enumerate usernames associated with TCP connections. Use this skill whenever you need to identify users running services on a target, enumerate usernames for password attacks, or assess if a target has identd running. Trigger for any pentesting task involving port 113, user enumeration, connection ownership discovery, or when you want to build username lists for further attacks. |
Ident Protocol Pentesting
Overview
The Ident Protocol (port 113) associates TCP connections with specific users. Originally designed for network management and security, it can inadvertently reveal usernames during security assessments.
Default port: 113/tcp
When to Use This Skill
Use this skill when:
- Port 113 is open during your reconnaissance
- You need to enumerate usernames on a target system
- You want to identify which user owns specific service connections
- You're building a username list for password attacks
- You're assessing if identd is running and what information it reveals
- You see
ident or auth in nmap output
Enumeration Methods
1. Manual Connection
Connect directly to port 113 to query user information:
nc -v {target_ip} 113
When connected:
- Press Enter to see if the service responds with any information
- Query specific connections:
{client_ip},{client_port},{server_ip},{server_port}
Example:
root@kali:~# nc -v 192.168.1.100 113
Connection to 192.168.1.100 113 port [tcp/ident] succeeded!
2. Nmap Scanning
Nmap's default scripts identify users on open ports:
nmap -sC {target_ip}
Look for auth-owners output which shows the user owning each service:
Example output:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.3p2 Debian 9
|_auth-owners: root
113/tcp open ident
|_auth-owners: identd
139/tcp open netbios-ssn Samba smbd 3.X - 4.X
|_auth-owners: root
445/tcp open netbios-ssn Samba smbd 3.0.24
|_auth-owners: root
3. ident-user-enum Tool
This specialized PERL script queries ident service across multiple ports:
Install:
apt install ident-user-enum
Usage:
ident-user-enum {target_ip} {port1} {port2} {port3}
Example:
ident-user-enum 192.168.1.100 22 113 139 445
Output format:
192.168.1.100:22 root
192.168.1.100:113 identd
192.168.1.100:139 root
192.168.1.100:445 root
Recommended Workflow
Step 1: Check if port 113 is open
nmap -p 113 {target_ip}
Step 2: Run enumeration
Choose based on your needs:
- Quick check:
nmap -sC -p 113,22,445 {target_ip}
- Detailed enumeration:
ident-user-enum {target_ip} 22 23 113 139 445 3306 5432
- Manual verification:
nc -v {target_ip} 113
Step 3: Document findings
Record:
- Usernames discovered
- Which ports/services they own
- Add to your password attack wordlists
Step 4: Assess security implications
- If identd is running, it may leak user information
- Consider recommending disabling identd for security
- Use discovered usernames for further attacks
Example Scenarios
Scenario 1: Quick Reconnaissance
nmap -sC -p 113,22,445 192.168.1.100
Scenario 2: Detailed User Enumeration
ident-user-enum 192.168.1.100 22 23 113 139 445 3306 5432
Scenario 3: Manual Verification
nc -v 192.168.1.100 113
Integration with Other Attacks
Use discovered usernames for:
- Password spraying attacks - Test common passwords against discovered usernames
- Brute force attempts - SSH, FTP, SMB authentication
- Social engineering research - Build profiles of target users
- Account enumeration - Check if usernames exist on other services
Common Errors and Responses
| Error | Meaning | Action |
|---|
| Connection refused | identd not running | Try other enumeration methods |
| Timeout | Firewall blocking port 113 | Skip ident, use other tools |
| No response | Service running but not configured | Try manual connection |
| Empty output | Service responds but no data | Check nmap auth-owners instead |
Security Considerations
For defenders:
- Privacy risk: Ident can reveal user information to unauthorized parties
- Modern practice: Many systems disable identd due to privacy concerns
- Recommendation: Disable identd on production systems
- Encryption: Use encrypted connections to protect user data
For pentesters:
- Ident is often disabled on modern systems
- When running, it's a valuable information source
- Combine with other enumeration for complete picture
Files to Check
If you gain access, check:
/etc/identd.conf - Ident daemon configuration/etc/default/identd - Service settings
References
