skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-redis

Tests Redis instances on port 6379 for unauthenticated access and RCE primitives during authorized engagements.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#exploitation#Redis#redis-cli#network services#RCE#unauthenticated access
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-redis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-redis
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-redis
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-redis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Redis is frequently deployed without authentication and exposed on port 6379, yet testers often miss the high-impact attack paths beyond simple banner grabbing. This Skill provides a structured methodology to enumerate Redis instances, verify unauthenticated access, and prove exploitation impact through concrete RCE primitives during authorized penetration tests.

Core Features & Use Cases

  • Enumeration and Authentication Testing: Uses nmap NSE scripts, redis-cli, Metasploit, hydra, and netexec to fingerprint versions, dump configuration, and brute-force AUTH credentials.
  • RCE Primitive Verification: Walks through CONFIG SET dir/dbfilename + SAVE webshell writes, SSH authorized_keys injection, cron job writes, MODULE LOAD command execution, Lua sandbox escape CVEs, and master-slave replication abuse.
  • Use Case: During an internal pentest, you find port 6379 open with no AUTH required. Follow the workflow to dump the keyspace for session tokens, write a PHP webshell to the webroot, and document a Critical finding with reproducible evidence and remediation steps.

Quick Start

Use the pentesting-redis skill to enumerate and test the Redis service at 10.10.10.5 for unauthenticated access and exploitation paths.

Frequently Asked Questions about pentesting-redis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Redis for unauthenticated access?▼

Run redis-cli -h <IP> info against port 6379. If it returns server statistics instead of -NOAUTH Authentication required, the instance accepts commands without credentials, which is the most commonly missed Redis finding.

How to get RCE from an unauthenticated Redis server?▼

Use CONFIG SET dir and dbfilename to repoint the RDB save path to a webroot, set a key containing a PHP payload, then run SAVE to write a webshell. Alternatives include writing SSH authorized_keys, cron jobs, or MODULE LOAD of a malicious .so exposing system.exec.

What tools are used for Redis penetration testing?▼

redis-cli and nc handle direct protocol interaction, nmap NSE provides redis-info and redis-brute scripts, Metasploit offers redis scanner and login modules, and netexec supports credential spraying. redis-rogue-server automates module-load RCE on Redis 5.0.5 and earlier.

Which Redis versions are vulnerable to Lua sandbox escape?▼

Redis versions below 8.2.2, 8.0.4, 7.4.6, 7.2.11, and 6.2.20 with Lua enabled are affected by CVE-2025-49844, CVE-2025-46817, and CVE-2025-46818. Older Debian-packaged builds are also vulnerable to CVE-2022-0543 sandbox escape leading to RCE.

Why does CONFIG SET fail during Redis exploitation?▼

The server may use rename-command to rename or disable CONFIG, FLUSHDB, and similar dangerous commands. Run CONFIG GET * to inspect the configuration and try alternate command names, or pivot to master-slave replication abuse with slaveof to push payloads from an attacker-controlled master.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
5

port-scan

Identify open ports and running services using naabu, masscan, and nmap.

Community
Intermediate
Prohao42Prohao42
120

linux-lateral-movement

Automate lateral movement across Linux hosts using SSH agent hijacking and credential harvesting.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

database-enumeration

Enumerate database services and test for default credentials and command execution vulnerabilities.

Official
Intermediate
paulchiupaulchiu
3

fix-redis

Identify and stop processes or containers occupying Redis port 6379.

Community
Intermediate