> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/misc/databases/redis.md). # Redis Redis (Remote Dictionary Server) is a source-available, in-memory storage, used as a distributed, in-memory key–value database, cache and message broker, with optional durability. ## Nmap redis scripts We can get general information about the redis database with the Nmap [redis-info](https://nmap.org/nsedoc/scripts/redis-info.html) script ```bash nmap -v -p 6379 --script redis-info $TARGET_IP ```
Example run ```bash ┌──(kali㉿kali)-[/mnt/…/OffSec_PG/PG_Practice/Easy/Wombo] └─$ nmap -v -p 6379 --script redis-info $TARGET_IP Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 12:07 +0200 NSE: Loaded 1 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 12:07 Completed NSE at 12:07, 0.00s elapsed Initiating Ping Scan at 12:07 Scanning 192.168.106.69 [4 ports] Completed Ping Scan at 12:07, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 12:07 Completed Parallel DNS resolution of 1 host. at 12:07, 0.50s elapsed Initiating SYN Stealth Scan at 12:07 Scanning 192.168.106.69 [1 port] Discovered open port 6379/tcp on 192.168.106.69 Completed SYN Stealth Scan at 12:07, 0.06s elapsed (1 total ports) NSE: Script scanning 192.168.106.69. Initiating NSE at 12:07 Completed NSE at 12:07, 0.21s elapsed Nmap scan report for 192.168.106.69 Host is up (0.035s latency). PORT STATE SERVICE 6379/tcp open redis | redis-info: | Version: 5.0.9 | Operating System: Linux 4.9.0-19-amd64 x86_64 | Architecture: 64 bits | Process ID: 557 | Used CPU (sys): 0.564000 | Used CPU (user): 0.596000 | Connected clients: 1 | Connected slaves: 0 | Used memory: 834.22K | Role: master | Bind addresses: | 0.0.0.0 | Client connections: |_ 192.168.45.232 NSE: Script Post-scanning. Initiating NSE at 12:07 Completed NSE at 12:07, 0.00s elapsed Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds Raw packets sent: 5 (196B) | Rcvd: 2 (72B) ```
## Redis-cli tool ### Installation ```bash sudo apt install redis-tools ``` ### Connect to database ```bash redis-cli -h $TARGET_IP ``` ### Get information about the server ```bash 10.129.223.23:6379> info # Server redis_version:5.0.7 redis_git_sha1:00000000 redis_git_dirty:0 redis_build_id:66bd629f924ac924 redis_mode:standalone os:Linux 5.4.0-77-generic x86_64 arch_bits:64 multiplexing_api:epoll atomicvar_api:atomic-builtin <---Lines removed for readability---> # Cluster cluster_enabled:0 # Keyspace db0:keys=4,expires=0,avg_ttl=0 10.129.223.23:6379> ``` At the final line of the output of the `info` command we can see that there is one database with index `0` containing 4 keys (`db0:keys=4`). ### Select a database ``` 10.129.223.23:6379> select 0 OK ``` ### List the keys ``` 10.129.223.23:6379> keys * 1) "flag" 2) "numb" 3) "stor" 4) "temp" ``` ### View keys View the `flag` key ``` 10.129.223.23:6379> get flag "0b" 10.129.223.23:6379> quit ``` ## Usage information
redis-cli --help ```bash ┌──(kali㉿kali)-[~] └─$ redis-cli --help redis-cli 7.0.15 Usage: redis-cli [OPTIONS] [cmd [arg [arg ...]]] -h Server hostname (default: 127.0.0.1). -p Server port (default: 6379). -s Server socket (overrides hostname and port). -a Password to use when connecting to the server. You can also use the REDISCLI_AUTH environment variable to pass this password more safely (if both are used, this argument takes precedence). --user Used to send ACL style 'AUTH username pass'. Needs -a. --pass Alias of -a for consistency with the new --user option. --askpass Force user to input password with mask from STDIN. If this argument is used, '-a' and REDISCLI_AUTH environment variable will be ignored. -u Server URI. -r Execute specified command N times. -i When -r is used, waits seconds per command. It is possible to specify sub-second times like -i 0.1. This interval is also used in --scan and --stat per cycle. and in --bigkeys, --memkeys, and --hotkeys per 100 cycles. -n Database number. -2 Start session in RESP2 protocol mode. -3 Start session in RESP3 protocol mode. -x Read last argument from STDIN (see example below). -X Read argument from STDIN (see example below). -d Delimiter between response bulks for raw formatting (default: \n). -D Delimiter between responses for raw formatting (default: \n). -c Enable cluster mode (follow -ASK and -MOVED redirections). -e Return exit error code when command execution fails. --tls Establish a secure TLS connection. --sni Server name indication for TLS. --cacert CA Certificate file to verify with. --cacertdir Directory where trusted CA certificates are stored. If neither cacert nor cacertdir are specified, the default system-wide trusted root certs configuration will apply. --insecure Allow insecure TLS connection by skipping cert validation. --cert Client certificate to authenticate with. --key Private key file to authenticate with. --tls-ciphers Sets the list of preferred ciphers (TLSv1.2 and below) in order of preference from highest to lowest separated by colon (":"). See the ciphers(1ssl) manpage for more information about the syntax of this string. --tls-ciphersuites Sets the list of preferred ciphersuites (TLSv1.3) in order of preference from highest to lowest separated by colon (":"). See the ciphers(1ssl) manpage for more information about the syntax of this string, and specifically for TLSv1.3 ciphersuites. --raw Use raw formatting for replies (default when STDOUT is not a tty). --no-raw Force formatted output even when STDOUT is not a tty. --quoted-input Force input to be handled as quoted strings. --csv Output in CSV format. --json Output in JSON format (default RESP3, use -2 if you want to use with RESP2). --quoted-json Same as --json, but produce ASCII-safe quoted strings, not Unicode. --show-pushes Whether to print RESP3 PUSH messages. Enabled by default when STDOUT is a tty but can be overridden with --show-pushes no. --stat Print rolling stats about server: mem, clients, ... --latency Enter a special mode continuously sampling latency. If you use this mode in an interactive session it runs forever displaying real-time stats. Otherwise if --raw or --csv is specified, or if you redirect the output to a non TTY, it samples the latency for 1 second (you can use -i to change the interval), then produces a single output and exits. --latency-history Like --latency but tracking latency changes over time. Default time interval is 15 sec. Change it using -i. --latency-dist Shows latency as a spectrum, requires xterm 256 colors. Default time interval is 1 sec. Change it using -i. --lru-test Simulate a cache workload with an 80-20 distribution. --replica Simulate a replica showing commands received from the master. --rdb Transfer an RDB dump from remote server to local file. Use filename of "-" to write to stdout. --functions-rdb Like --rdb but only get the functions (not the keys) when getting the RDB dump file. --pipe Transfer raw Redis protocol from stdin to server. --pipe-timeout In --pipe mode, abort with error if after sending all data. no reply is received within seconds. Default timeout: 30. Use 0 to wait forever. --bigkeys Sample Redis keys looking for keys with many elements (complexity). --memkeys Sample Redis keys looking for keys consuming a lot of memory. --memkeys-samples Sample Redis keys looking for keys consuming a lot of memory. And define number of key elements to sample --hotkeys Sample Redis keys looking for hot keys. only works when maxmemory-policy is *lfu. --scan List all keys using the SCAN command. --pattern Keys pattern when using the --scan, --bigkeys or --hotkeys options (default: *). --quoted-pattern Same as --pattern, but the specified string can be quoted, in order to pass an otherwise non binary-safe string. --intrinsic-latency Run a test to measure intrinsic system latency. The test will run for the specified amount of seconds. --eval Send an EVAL command using the Lua script at . --ldb Used with --eval enable the Redis Lua debugger. --ldb-sync-mode Like --ldb but uses the synchronous Lua debugger, in this mode the server is blocked and script changes are not rolled back from the server memory. --cluster [args...] [opts...] Cluster Manager command and arguments (see below). --verbose Verbose mode. --no-auth-warning Don't show warning message when using password on command line interface. --help Output this help and exit. --version Output version and exit. Cluster Manager Commands: Use --cluster help to list all available cluster manager commands. Examples: cat /etc/passwd | redis-cli -x set mypasswd redis-cli -D "" --raw dump key > key.dump && redis-cli -X dump_tag restore key2 0 dump_tag replace < key.dump redis-cli -r 100 lpush mylist x redis-cli -r 100 -i 1 info | grep used_memory_human: redis-cli --quoted-input set '"null-\x00-separated"' value redis-cli --eval myscript.lua key1 key2 , arg1 arg2 arg3 redis-cli --scan --pattern '*:12345*' (Note: when using --eval the comma separates KEYS[] from ARGV[] items) When no command is given, redis-cli starts in interactive mode. Type "help" in interactive mode for information on available commands and settings. ```
## Resources Pentesting Redis - HackTricks: Redis - Wikipedia: