The dict:// scheme, supported by curl-backed clients, opens a TCP connection to the host and port in the URL and sends a command line built from the path. It was designed to query dictionary servers, but because it writes an attacker-chosen line to an arbitrary port and returns the reply, it doubles as a way to talk to any line-based internal service.
Shape of the request#
The canonical form carries a command and arguments after the host:
dict://127.0.0.1:6379/info
dict://127.0.0.1:11211/stats
The client connects to the port and sends the word as a line, then reads the response. curl prepends its own CLIENT announcement line before the command, so a line-based service sees one extra line first; Redis and memcached tolerate it and still process the command that follows. Redis replies to info with its server block, and memcached replies to stats, both of which confirm the service and leak version and configuration.
One command per request#
dict:// sends a single line per request, so it is ideal for probing and one-shot commands rather than multi-step sequences. A command with arguments must percent-encode its spaces, because a curl-backed client rejects a URL containing a literal space before it connects:
dict://127.0.0.1:11211/stats%20items # memcached: stats items
dict://127.0.0.1:6379/COMMAND%20DOCS # Redis: one command, spaces encoded
Each request is a fresh connection and a single command. Reading a service banner or a one-command reply this way fingerprints what is listening on a port discovered through Port scanning. When a sequence of commands is needed (for example the full Redis write-to-disk chain, or any value containing newlines), the single-line limit is the reason to move to Gopher, which writes a whole crafted stream in one request.
Probing closed versus open#
Because the reply (or the connection error) comes back, dict:// distinguishes an open port that speaks a known protocol from one that does not, refining a port scan into service identification. Point it at each candidate port and read whether a recognizable banner returns.