# Ident Pentesting

> Pentest the Ident Protocol (port 113) to enumerate usernames associated with TCP connections. Use this skill whenever you need to identify users running services on a target, enumerate usernames for password attacks, or assess if a target has identd running. Trigger for any pentesting task involving port 113, user enumeration, connection ownership discovery, or when you want to build username lists for further attacks.

- Skill: `abelrguezr/ident-pentesting` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/ident-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/ident-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/ident-pentesting

---


# Ident Protocol Pentesting

## Overview

The **Ident Protocol** (port 113) associates TCP connections with specific users. Originally designed for network management and security, it can inadvertently reveal usernames during security assessments.

**Default port:** 113/tcp

## When to Use This Skill

Use this skill when:
- Port 113 is open during your reconnaissance
- You need to enumerate usernames on a target system
- You want to identify which user owns specific service connections
- You're building a username list for password attacks
- You're assessing if identd is running and what information it reveals
- You see `ident` or `auth` in nmap output

## Enumeration Methods

### 1. Manual Connection

Connect directly to port 113 to query user information:

```bash
nc -v {target_ip} 113
```

When connected:
- Press Enter to see if the service responds with any information
- Query specific connections: `{client_ip},{client_port},{server_ip},{server_port}`

**Example:**
```
root@kali:~# nc -v 192.168.1.100 113
Connection to 192.168.1.100 113 port [tcp/ident] succeeded!
```

### 2. Nmap Scanning

Nmap's default scripts identify users on open ports:

```bash
nmap -sC {target_ip}
```

Look for `auth-owners` output which shows the user owning each service:

**Example output:**
```
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 4.3p2 Debian 9
|_auth-owners: root
113/tcp open  ident
|_auth-owners: identd
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X
|_auth-owners: root
445/tcp open  netbios-ssn Samba smbd 3.0.24
|_auth-owners: root
```

### 3. ident-user-enum Tool

This specialized PERL script queries ident service across multiple ports:

**Install:**
```bash
apt install ident-user-enum
```

**Usage:**
```bash
ident-user-enum {target_ip} {port1} {port2} {port3}
```

**Example:**
```bash
ident-user-enum 192.168.1.100 22 113 139 445
```

**Output format:**
```
192.168.1.100:22  root
192.168.1.100:113 identd
192.168.1.100:139 root
192.168.1.100:445 root
```

## Recommended Workflow

### Step 1: Check if port 113 is open
```bash
nmap -p 113 {target_ip}
```

### Step 2: Run enumeration
Choose based on your needs:
- **Quick check:** `nmap -sC -p 113,22,445 {target_ip}`
- **Detailed enumeration:** `ident-user-enum {target_ip} 22 23 113 139 445 3306 5432`
- **Manual verification:** `nc -v {target_ip} 113`

### Step 3: Document findings
Record:
- Usernames discovered
- Which ports/services they own
- Add to your password attack wordlists

### Step 4: Assess security implications
- If identd is running, it may leak user information
- Consider recommending disabling identd for security
- Use discovered usernames for further attacks

## Example Scenarios

### Scenario 1: Quick Reconnaissance
```bash
nmap -sC -p 113,22,445 192.168.1.100
```

### Scenario 2: Detailed User Enumeration
```bash
ident-user-enum 192.168.1.100 22 23 113 139 445 3306 5432
```

### Scenario 3: Manual Verification
```bash
nc -v 192.168.1.100 113
# Press Enter or send query
```

## Integration with Other Attacks

Use discovered usernames for:
- **Password spraying attacks** - Test common passwords against discovered usernames
- **Brute force attempts** - SSH, FTP, SMB authentication
- **Social engineering research** - Build profiles of target users
- **Account enumeration** - Check if usernames exist on other services

## Common Errors and Responses

| Error | Meaning | Action |
|-------|---------|--------|
| Connection refused | identd not running | Try other enumeration methods |
| Timeout | Firewall blocking port 113 | Skip ident, use other tools |
| No response | Service running but not configured | Try manual connection |
| Empty output | Service responds but no data | Check nmap auth-owners instead |

## Security Considerations

**For defenders:**
- **Privacy risk**: Ident can reveal user information to unauthorized parties
- **Modern practice**: Many systems disable identd due to privacy concerns
- **Recommendation**: Disable identd on production systems
- **Encryption**: Use encrypted connections to protect user data

**For pentesters:**
- Ident is often disabled on modern systems
- When running, it's a valuable information source
- Combine with other enumeration for complete picture

## Files to Check

If you gain access, check:
- `/etc/identd.conf` - Ident daemon configuration
- `/etc/default/identd` - Service settings

## References

- [HackTricks - Ident Pentesting](https://book.hacktricks.wiki/en/network-services-pentesting/113-pentesting-ident.html)
- [ident-user-enum GitHub](https://github.com/pentestmonkey/ident-user-enum)
- [RFC 1413 - Ident Protocol](https://datatracker.ietf.org/doc/html/rfc1413)