What problem does it solve?
Exposed Memcached instances frequently run without authentication, leaking cached session tokens, credentials, and query results while also enabling UDP reflection DDoS attacks. This Skill provides a structured workflow to enumerate, exploit, and document these weaknesses during authorized penetration tests.
Core Features & Use Cases
- Unauthenticated Enumeration: Confirm exposure with
version, stats, and stats items over plain nc, plus nmap NSE and Metasploit auxiliary modules.
- Key Dumping & Data Exfiltration: Extract all key names and values using
stats cachedump (≤ 1.4.30), lru_crawler metadump (≥ 1.4.31), or libmemcached-tools (memcdump/memccat).
- Cache Poisoning & UDP Amplification Checks: Verify write access with
set commands and assess UDP 11211 reflection/amplification DDoS risk.
- Use Case: During an internal pentest, you find port 11211 open. You dump cached session objects with
memcdump/memccat, replay a valid session token against the web app, and report the exposure with remediation steps.
Quick Start
Use the pentesting-memcached skill to enumerate and dump keys from the Memcached server at 10.0.0.5 on port 11211 and document any unauthenticated access findings.
