πŸ•΅οΈ
VeryLazyTech
πŸ“œ MediumπŸ›’ My ShopπŸ‘Ύ GithubπŸ“© Telegram πŸ“Ί YouTubeβœ– Twitter
  • πŸ•΅οΈWelcome!
    • VeryLazyTech
    • Support VeryLazyTech
      • πŸ‘Ύ GitHub
      • πŸ“œ Medium
      • β˜• My Shop
      • πŸ“Ί YouTube
      • βœ– Twitter
      • πŸ“© Telegram
  • πŸ›‘οΈ Vulnerabilities and Exploits
    • CVE - POC
      • Unauthenticated RCE Flaw in Rejetto HTTP File Server - CVE-2024-23692
      • POC - CVE-2024–4956 - Nexus Repository Manager 3 Unauthenticated Path Traversal
      • POC - CVE-2024-45241: Path Traversal in CentralSquare's CryWolf
      • Telerik Auth Bypass CVE-2024-4358
      • Check Point Security Gateways Information Disclosure - CVE-2024-24919
      • CVE-2024-23897 - Jenkins File Read Vulnerability
      • CVE-2024–10914- Command Injection Vulnerability in name parameter for D-Link NAS
      • POC - CVE-2024-21534 Jsonpath-plus vulnerable to Remote Code Execution (RCE)
      • CVE-2024-9935 - PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Unauthenticated Arbitrary
      • CVE-2024-50623- Cleo Unrestricted file upload and download
      • POC - WordPress File Upload plugin, in the wfu_file_downloader.php file before version <= 4.24.11
      • POC - Remote and unauthenticated attacker can send crafted HTTP requests to RCE - cve-2025-3248
      • POCβ€Š-β€ŠCVE-2025–2539 File Away <= 3.9.9.0.1β€Š-β€ŠMissing Authorization to Unauthenticated Arbitrary File
      • POC - CVE-2025-29306 FOXCMS /images/index.html Code Execution Vulnerability
  • πŸ•΅οΈβ€β™‚οΈDorks
    • GitHub Dorks
    • Google Dork Online Tool
  • πŸ“š Resources
    • Top Hacking Books for 2024: FREE and Paid
    • How to Study for OSCP with the PWK Book PDF
    • Top 20 phishing tools to use in 2024
    • Top 8 Bug Bounty Books for 2025: Must-Reads for Ethical Hackers
    • Top Hacking Tools and Skills You Need to Learn in 2025
    • Offensive Cloud
    • Penetration Testing & Hacking Tools List
    • Top Cybersecurity Books by Topic
  • The Ultimate Penetration Testing Methodology (2025 Edition)
  • πŸ•ΈοΈPentesting Web
    • Client Side Template Injection (CSTI)
    • Identify a Server’s Origin IP
    • 2FA/MFA/OTP Bypass
  • IDOR
  • Open Redirect
  • Subdomain Takeover
  • Penetration Testing WiFi Networks
  • Client-Side Path Traversal
  • Clickjacking
  • Command Injection
  • JWT Vulnerabilities
  • Bypass rating limit
  • CORS - Misconfigurations & Bypass
  • LDAP Injection
  • File upload vulnerabilities
  • Content Security Policy (CSP) bypass
  • Brute Force - Services, web, local, tools & wordlists
  • 🐧Linux
    • Practical Linux Commands
    • Bypassing Bash Restrictions - Rbash
    • Privilege escalation - Linux
  • Linux Environment Variables
  • πŸͺŸWindows
    • Active Directory Methodology
    • Antivirus (AV) Bypass
  • 🌐Network Pentesting
    • FTP - Port 21
    • SSH- Port 22
    • Telnet - Port 23
    • SMTP/s - Port 25,465,587
    • WHOIS - Port 43
    • TACACS+ - Port 49
    • DNS - Port 53
    • TFTP/Bittorrent-tracker - Port 69/UDP
    • Finger - Port 79
    • Web - Port 80,443
    • Kerberos - Port 88
    • POP - Port 110/995
    • Portmapper - Port 111/TCP/UDP
    • Ident - Port 113
    • NTP - Port 123/UDP
    • MSRPC - Port 135, 539
    • NetBios - Port 137,138,139
    • SMB - Port 139 445
    • IMAP - Port 143, 993
    • SNMP - Ports 161, 162, 10161, and 10162/UDP
    • IRC - Ports 194,6667,6660-7000
    • Check Point Firewall - Port 264
    • LDAP - Ports 389, 636, 3268, 3269
    • IPsec/IKE VPN - Port 500/UDP
    • Modbus - Port 502
    • Rexec - Port 512
    • Rlogin - Port 513
    • Rsh - Port 514
    • Line Printer Daemon (LPD) - Port 515
    • Apple Filing Protocol (AFP) - PORT 548
    • RTSP - Port 554, 8554
    • IPMI - Port 623/UDP/TCP
    • Internet Printing Protocol (IPP) - Port 631
    • EPP - Port 700
    • Rsync - Port 873
    • Rusersd Service - Port 1026
    • Socks - Port 1080
    • Java RMI - RMI-IIOP - Port 1098/1099/1050
    • MSSQL (Microsoft SQL Server) - Port 1433
    • Oracle TNS Listener - Port 1521,1522-1529
  • PPTP - Port 1723
  • MQTT (Message Queuing Telemetry Transport) - Port 1883
  • Compaq HP Insight Manager - Port 2301, 2381
  • NFS Service - Port 2049
  • Docker - Port 2375,2376
  • Squid - Port 3128
  • iScsi - Port 3260
  • SAPRouter - Port 3299
  • 😎Post-exploitation
    • File Transfer Cheatsheet: Windows andΒ Linux
  • πŸ§‘β€πŸ”§Technical guides
    • Kali Linux - Installation
Powered by GitBook
On this page
  • Basic Information
  • Enumeration
  • Banner
  • Manual
  • Find and scan IRC services

Was this helpful?

  1. Network Pentesting

IRC - Ports 194,6667,6660-7000

IRC, initially a plain text protocol, was assigned 194/TCP by IANA but is commonly run on 6667/TCP and similar ports to avoid needing root privileges for operation.

Become VeryLazyTech member! 🎁

  • Follow us on:

    • βœ– Twitter @VeryLazyTech.

    • πŸ‘Ύ Github @VeryLazyTech.

    • πŸ“œ Medium @VeryLazyTech.

    • πŸ“Ί YouTube @VeryLazyTech.

    • πŸ“© Telegram @VeryLazyTech.

    • πŸ•΅οΈβ€β™‚οΈ My Site @VeryLazyTech.

  • Visit our shop for e-books and courses. πŸ“š

Basic Information

IRC, initially a plain text protocol, was assigned 194/TCP by IANA but is commonly run on 6667/TCP and similar ports to avoid needing root privileges for operation.

A nickname is all that's needed to connect to a server. Following connection, the server performs a reverse-DNS lookup on the user's IP.

Users are divided into operators, who need a username and password for more access, and regular users. Operators have varying levels of privileges, with administrators at the top.

Default ports: 194, 6667, 6660-7000

PORT     STATE SERVICE
6667/tcp open  irc

Enumeration

Banner

IRC can support TLS.

nc -vn <IP> <PORT>
openssl s_client -connect <IP>:<PORT> -quiet

Manual

Here you can see how to connect and access the IRC using some random nickname and then enumerate some interesting info. You can learn more commands of IRC here.

#Connection with random nickname
USER ran213eqdw123 0 * ran213eqdw123
NICK ran213eqdw123
#If a PING :<random> is responded you need to send
#PONG :<received random>

VERSION
HELP
INFO
LINKS
HELPOP USERCMDS
HELPOP OPERCMDS
OPERATOR CAPA
ADMIN      #Admin info
USERS      #Current number of users
TIME       #Server's time
STATS a    #Only operators should be able to run this
NAMES      #List channel names and usernames inside of each channel -> Nombre del canal y nombre de las personas que estan dentro
LIST       #List channel names along with channel banner
WHOIS <USERNAME>      #WHOIS a username
USERHOST <USERNAME>   #If available, get hostname of a user
USERIP <USERNAME>     #If available, get ip of a user
JOIN <CHANNEL_NAME>   #Connect to a channel

#Operator creds Brute-Force
OPER <USERNAME> <PASSWORD>

You can, also, atttempt to login to the server with a password. The default password for ngIRCd is wealllikedebian.

PASS wealllikedebian
NICK patrick
USER test1 test2 <IP> :test3

Find and scan IRC services

nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 <ip>

Learn & practice For the OSCP.

Support VeryLazyTech πŸŽ‰

Become VeryLazyTech member! 🎁

  • Follow us on:

    • βœ– Twitter @VeryLazyTech.

    • πŸ‘Ύ Github @VeryLazyTech.

    • πŸ“œ Medium @VeryLazyTech.

    • πŸ“Ί YouTube @VeryLazyTech.

    • πŸ“© Telegram @VeryLazyTech.

    • πŸ•΅οΈβ€β™‚οΈ My Site @VeryLazyTech.

  • Visit our shop for e-books and courses. πŸ“š

PreviousSNMP - Ports 161, 162, 10161, and 10162/UDPNextCheck Point Firewall - Port 264

Last updated 2 months ago

Was this helpful?

🌐