EPP - Port 700
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
Extensible Provisioning Protocol (EPP) is the backbone of domain name management for registrars and registries across the globe. Used for provisioning domain names, contacts, and name servers, EPP’s XML-based communication over TCP makes it a high-value target for attackers. Its sensitivity, paired with misconfigurations or improper implementation, can expose an organization to domain hijacking, unauthorized domain management, and registrar abuse.
This article dives deep into the architecture of EPP, common attack surfaces, advanced exploitation techniques, and countermeasures.
EPP operates over TCP (usually port 700) and employs XML commands to handle domain transactions. The protocol uses a request-response model where the client (typically a registrar) sends commands to the server (registry operator).
EPP commands include:
login, logout
check, info, create, update, delete, renew, transfer
EPP servers are frequently deployed behind authentication layers, yet many implementations leave tell-tale signs through banners, misconfigured TLS, or weak access controls
Developers often embed EPP credentials in:
Version-controlled config files (e.g., epp-config.xml)
Jenkins pipeline artifacts
Docker container layers
Some misconfigured EPP servers respond with greeting XMLs before authentication, revealing internal information like:
Server version
Supported extensions (e.g., fee, launch, rgp)
Registrar IDs
Nmap Script:
Using the check command with wildcards or automation can confirm domain availability without rate limiting.
Example:
If unauthenticated, this becomes a goldmine.
Once credentials are obtained, the attacker can:
Transfer domain ownership using transfer command
Modify nameservers with update
Hijack entire domain portfolios
Attackers often create automation loops that target multiple domains via authenticated sessions.
Registrars using shared reverse proxies or load balancers may incorrectly manage session states. Crafting replay requests with stolen session tokens allows lateral movement between authenticated tenants.
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚