logo

Port 113 – Ident (Identification Protocol)

Service:

auth

Protocol:

TCP

Port:

113

Used for:

User identification protocol for validating connections and authentication

Why It’s Open

Port 113 is used for the Identification Protocol (Ident), an older authentication mechanism primarily used by IRC servers and some legacy systems. While largely obsolete in modern networks, some systems maintain this service for backward compatibility with certain applications that expect ident responses.

Common Risks

  • Username Disclosure
    Reveals valid system usernames to potential attackers
  • System Fingerprinting
    Responses may expose OS and service information
  • Legacy Vulnerabilities
    Older implementations contain unpatched security flaws
  • Denial of Service
    Can be abused to consume system resources
  • False Security
    Provides unreliable authentication information

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

Enumeration & Testing

Check if it’s open:

Terminal window
nmap -sT -p 113

Basic ident query:

Terminal window
echo "6667,113" | nc -w 3  113

Scan for ident info:

Terminal window
amap -p 113

What to Look For

CheckpointWhat it means
Active ident servicePotential information leak
Username disclosureValid usernames exposed
Verbose error messagesAdditional system details
Unrestricted accessOpen to network-wide queries

Mitigation

  • Disable Service
    Remove identd unless specifically required
  • Network Filtering
    Block port 113 at perimeter firewalls
  • Response Limiting
    Configure to return minimal information
  • Modern Alternatives
    Replace with secure authentication methods
  • Monitoring
    Log all ident query attempts

TL;DR

  • Obsolete authentication protocol
  • Information disclosure risk
  • Should be disabled by default
  • Provides minimal security value

Known CVEs and Exploits