These are the open, standardized real-time chat protocols, each with several independent server implementations rather than a single vendor product. That shape drives the offensive approach: the protocol is public, so you speak it directly over a socket, and the value is in self-service surface (open registration, roster and directory enumeration, mechanism downgrade) plus bugs specific to whichever daemon is deployed. All three protocols federate or link servers, so a single compromised node often reaches a wider network of users and rooms.
Triage#
One sweep tells you which protocol, and the banner or stream handshake tells you which daemon:
nmap -sV -p6667,6697,5222,5269,8448 <target>
# 6667 IRC plaintext 6697 IRC over TLS
# 5222 XMPP client (STARTTLS) 5223 XMPP legacy TLS 5269 XMPP server-to-server
# 8008 Matrix client-server 8448 Matrix federation 443 Matrix behind a reverse proxy
Fingerprint by speaking the protocol:
- IRC answers a raw
NICK/USERhandshake with numeric replies and aVERSIONreply naming the ircd (UnrealIRCd, InspIRCd, Charybdis, ngIRCd). See IRC. - XMPP answers an opening
<stream:stream>with a<stream:features>block whosefromand namespaces name the server (ejabberd, Prosody, Openfire). See XMPP. - Matrix answers
GET /_matrix/client/versionsand/_matrix/federation/v1/versionwith JSON naming Synapse, Dendrite, or Conduit. See Matrix.
For each, the recurring questions are the same: can you enumerate users, rooms, and server features without credentials; can you self-provision or authenticate as someone; and does the specific daemon have a known server-side flaw.
Subtopics#
- IRC: text protocol on 6667/6697, channels, NickServ/ChanServ services, and IRC operators, with backdoored and vulnerable ircd builds.
- XMPP: XML streams on 5222/5223/5269, service discovery, SASL and in-band registration, and server flaws in ejabberd, Prosody, and Openfire.
- Matrix: HTTP/JSON API on 8008/8448/443, open registration and shared-secret admin, media SSRF, and federation abuse against Synapse, Dendrite, and Conduit.