Redis enumeration

Redis is an in-memory key-value store (port 6379 by default). It's very fast and used as a cache, queue or session backend, but it's often deployed without authentication or with a weak password, and its contents can hide credentials, session tokens or application data useful to the attacker.

The client is redis-cli. If it requires a password (requirepass directive), pass it with -a:

redis-cli -h <ip>                       # no auth
redis-cli -h <ip> -a <pass>             # with password

Once in, basic enumeration:

INFO                  # version, mode, persistence, number of keys
ACL WHOAMI            # current user (Redis 6+)
KEYS *                # list ALL keys (in labs; use SCAN in prod)
TYPE <key>            # type: string, set, hash, list, zset...
GET <key>             # read a string
SMEMBERS <key>        # read a set
HGETALL <key>         # read a hash

The interesting stuff is usually in the values: serialised user objects (JSON), encrypted passwords, tokens. In Atom, a key held the Administrator object with its EncryptedPassword.

Beyond reading. Unauthenticated Redis with permissions can lead to RCE or file writes (CONFIG SET dir + SET to write a webshell or SSH key, module abuse via MODULE LOAD, or RCE via replication). Here, though, the Redis value was purely informative: the credential that opened the next step.

How to detect it. On the network, the signature is a connection to 6379 from a non-local IP against a Redis with no requirepass (an nmap -p6379 scan or an external redis-cli -h). In Redis itself, the monitor or slowlog shows a KEYS * (a full keyspace walk, which an application avoids in favour of SCAN) and INFO/CONFIG GET followed by bulk reads: a recon pattern, not normal use. A repeated failed AUTH gives away requirepass brute-forcing. Later escalation (webshell/SSH) leaves the trace of CONFIG SET dir/dbfilename or MODULE LOAD (module RCE).

Defence. Require a strong password (requirepass) and/or ACLs, don't expose 6379 to untrusted networks (bind to localhost), disable dangerous commands (CONFIG, MODULE) and don't store cleartext/reversible secrets. Related to the credential reuse that usually follows a database finding and to Redis RCE via MODULE LOAD.