IPP, CUPS and JetDirect

Default Ports: 631 (IPP/CUPS), 9100 (JetDirect/raw printing)

IPP, CUPS, and JetDirect are printing protocols and services used by printers, print servers, and Linux/macOS print systems. In pentests, exposed print services can leak device info, jobs, usernames, internal names, and sometimes allow unauthenticated print or admin actions.

Connect​

Using Browser​

CUPS often exposes a web interface on port 631.

http://target.com:631/  
https://target.com:631/  

Using curl​

HTTP checks identify CUPS, IPP, and admin paths.

curl -I http://target.com:631/  
curl -I http://target.com:631/admin  
curl -I http://target.com:631/printers/  

Using lpstat​

lpstat lists printers and queues from CUPS.

lpstat -h target.com:631 -v  
lpstat -h target.com:631 -p  
lpstat -h target.com:631 -o  

Using ipptool​

ipptool queries IPP attributes.

ipptool -tv ipp://target.com:631/printers/printer get-printer-attributes.test  
ipptool -tv ipp://target.com:631/printers/printer get-jobs.test  

Using Netcat for JetDirect​

JetDirect accepts raw print data on port 9100.

echo "authorized print test" | nc target.com 9100  
printf "\033%-12345X@PJL INFO ID\r\n\033%-12345X" | nc target.com 9100  

Recon​

Service Detection with Nmap​

Scan print ports and nearby web interfaces.

nmap -p 631,9100,515,80,443 -sV target.com  
nmap -p 631 --script http-title,http-headers target.com  
nmap -p 9100 --script pjl-ready-message target.com  

IPP Enumeration​

IPP attributes reveal printer names, locations, models, and supported operations.

ipptool -tv ipp://target.com:631/ipp/print get-printer-attributes.test  
ipptool -tv ipp://target.com:631/printers/printer get-printer-attributes.test  

CUPS Fingerprinting​

CUPS pages reveal version and queue names.

curl -s http://target.com:631/ | grep -Ei 'cups|printer|admin|version'  
curl -s http://target.com:631/printers/ | grep -Ei 'printer|queue|class'  

JetDirect Fingerprinting​

PJL commands may return device model and status.

printf "\033%-12345X@PJL INFO ID\r\n\033%-12345X" | nc target.com 9100  
printf "\033%-12345X@PJL INFO STATUS\r\n\033%-12345X" | nc target.com 9100  

Enumeration​

Queue Enumeration​

Queues reveal printer names, locations, and job status.

lpstat -h target.com:631 -v  
lpstat -h target.com:631 -p  
lpstat -h target.com:631 -o  

Job Enumeration​

Print jobs may leak usernames, filenames, or document titles.

ipptool -tv ipp://target.com:631/printers/printer get-jobs.test  
curl -s http://target.com:631/jobs/  

Device Attribute Enumeration​

Attributes expose model, firmware, location, and supported operations.

ipptool -tv ipp://target.com:631/printers/printer get-printer-attributes.test  
printf "\033%-12345X@PJL INFO VARIABLES\r\n\033%-12345X" | nc target.com 9100  

Admin Path Enumeration​

Check whether CUPS admin pages require authentication.

curl -i http://target.com:631/admin  
curl -i http://target.com:631/admin/conf/cupsd.conf  

Attack Vectors​

Unauthenticated Printing​

Open queues may allow anyone to submit jobs.

lp -h target.com:631 -d printer test.txt  
echo "authorized print test" | nc target.com 9100  

Job Information Disclosure​

Jobs and history can reveal users, filenames, and departments.

lpstat -h target.com:631 -o  
curl -s http://target.com:631/jobs/  

CUPS Admin Exposure​

Exposed admin endpoints may allow configuration changes if auth is weak.

curl -i http://target.com:631/admin  
curl -i http://target.com:631/admin/log/error_log  

PJL Information Leakage​

PJL can disclose device information on raw print ports.

printf "\033%-12345X@PJL INFO ID\r\n\033%-12345X" | nc target.com 9100  
printf "\033%-12345X@PJL INFO CONFIG\r\n\033%-12345X" | nc target.com 9100  

Printer Abuse​

Printing tests should use a small controlled page to avoid disruption.

echo "Authorized pentest print check" | nc target.com 9100  

Post-Exploitation​

Printer Inventory​

Collect queues, models, and locations for the report.

lpstat -h target.com:631 -v > printers.txt  
ipptool -tv ipp://target.com:631/printers/printer get-printer-attributes.test > printer-attributes.txt  

User and Document Review​

Review job metadata only; avoid retrieving document content unless scoped.

lpstat -h target.com:631 -o > print-jobs.txt  
grep -Ei 'user|owner|job|document|title' print-jobs.txt  

Logging Check​

Submit one controlled job and confirm it is logged.

echo "Authorized pentest print check" | nc target.com 9100  

Useful Tools​

Tool| Purpose
---|---
nmap| Port and service detection
curl| CUPS web checks
lpstat| Queue and job enumeration
lp| Controlled print submission
ipptool| IPP attribute queries
nc| JetDirect/PJL testing
PRET| Printer exploitation framework

Security Misconfigurations​

Misconfiguration| Risk
---|---
CUPS exposed broadly| Printer and queue disclosure
Unauthenticated printing| Abuse and disruption
Job history visible| User and document metadata leakage
CUPS admin exposed| Configuration risk
JetDirect exposed| Raw print and PJL information leakage
Weak printer credentials| Device administration
No network segmentation| Printer attack surface exposure