Brute forcing Redis passwords
Redis does not support user authentication and can only be protected by a password. It is commonly found exposed with no password too. As penetration testers, we must check for weak passwords or no authentication every time we see this service.
This recipe describes how to perform brute force password auditing against Redis with Nmap.
How to do it...
To perform brute force password auditing against Redis, use the following Nmap command:
$ nmap -p6379 --script redis-brute <target>If authentication is not enabled, the following message will be returned:
PORT STATE SERVICE 6379/tcp open unknown |_redis-brute: Server does not require authentication
How it works...
Redis does not support user authentication and can only be protected by a password if configured. But in real-life scenarios, there will be a lot of instances with no password. The script redis-brute was designed to aid with performing brute force password auditing against Redis. The...