194,6667,6660-7000 - Pentesting IRC
WhiteIntel is a dark-web fueled search engine that offers free functionalities to check if a company or its customers have been compromised by stealer malwares.
Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.
You can check their website and try their engine for free at:
Basic Information
IRC, initially a plain text protocol, was assigned 194/TCP by IANA but is commonly run on 6667/TCP and similar ports to avoid needing root privileges for operation.
A nickname is all that's needed to connect to a server. Following connection, the server performs a reverse-DNS lookup on the user's IP.
Users are divided into operators, who need a username and password for more access, and regular users. Operators have varying levels of privileges, with administrators at the top.
Default ports: 194, 6667, 6660-7000
Enumeration
Banner
IRC can support TLS.
Manual
Here you can see how to connect and access the IRC using some random nickname and then enumerate some interesting info. You can learn more commands of IRC here.
You can, also, atttempt to login to the server with a password. The default password for ngIRCd is wealllikedebian
.
Find and scan IRC services
Shodan
looking up your hostname
WhiteIntel is a dark-web fueled search engine that offers free functionalities to check if a company or its customers have been compromised by stealer malwares.
Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.
You can check their website and try their engine for free at:
Last updated