Redis profile and unauthorized access
Brief introduction of redis profile and unauthorized access to 0x00 redis
REmote DIctionary Server (Redis) is a key-value storage system written by Salvatore Sanfilippo.
Redis is an open source log database written in ANSI C language, complies with BSD protocol, supports network, can be memory-based and persistent, Key-Value database, and provides API in multiple languages. It is often called a data structure server because the value can be of types such as String, Map, list, sets, and sorted sets.
0x01 redis profile
Profile name: redis.conf
Default path: / etc/redis.conf
Default port: 6379
Fields related to permissions and passwords in the redis configuration file:
# bind 192.168.1.100 10.0.0.The bind 127.0.0.1:: internet, binding to all the interfaces is dangerous and will expose the# following bind directive, that will force Redis to listen only intobind 0.0.0.The If the master is password protected (using the "requirepass" configuration# requirepass foobared
Bind represents the ip allowed to be accessed
Password for requirepass code to access redis
In 0x02's case, Redis exists unauthorized access startup mode corresponds to whether there is unauthorized access to the process configuration file. / redis-server00:00:00 redis-server 0.0.0.0 redis-server redis.confredis-server 0.0.0.0:6379bind 6379 no configuration file does not exist. / redis-server redis.confredis-server 0.0.0.0 redis-server redis.confredis-server 0.0.0.0:6379bind 6379 default configuration does not exist. / redis-server redis. Confredis-server 0.0.0.0:6379requirepass foobared Bind 0.0.0.0 does not exist
To sum up, the conditions for unauthorized access to the table name redis are:
The configuration file (. / redis-server redis.conf) is loaded to allow any ip login, or your own ip is within the allowable range (bind 0.0.0.0) without a password (# requirepass foobared)
