Re: UDP payload for memcached (11211/udp)
Daniel Miller <[email protected]>
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <CABmvJnMQf4hx3KduSmsEakVPrumyScXr6s3YfV9B+62CZ-wbtw@mail.gmail.com> |
David, I actually added one earlier today, but using the 'version' payload instead of the 'stats' one. Everyone is using 'stats' for testing the DDoS amplification issue, so it's likely to be flagged by IDS signatures. We use 'stats' for version detection because it has overlap (on TCP) with Zookeeper (and because it was already suggested by someone once.) Dan On Fri, Mar 2, 2018 at 7:49 PM, David Fifield <[email protected]> wrote: > Marek suggests a payload for detecting memcached on UDP: > https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from- > port-11211/#memcachedusers > > (untested by me) > > udp 11211 "\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n" > _______________________________________________ > Sent through the dev mailing list > https://nmap.org/mailman/listinfo/dev > Archived at http://seclists.org/nmap-dev/ > _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/