Telnet is a remote-terminal protocol commonly exposed on TCP 23. Its default data stream is plaintext, so the login, password, commands, and output are visible to a positioned observer. Extensions such as the Telnet ENCRYPT option exist, but support and successful negotiation must be verified and the historic algorithms are not a substitute for SSH. Telnet persists on legacy systems, network equipment, and IoT devices, where its attack surface includes weak authentication, verbose identification, implementation-specific vulnerabilities, and interception or live hijacking of sessions that remain plaintext.
nmap -p23 -sV --script telnet-ntlm-info,telnet-encryption <target>
nc <target> 23 # banner and login prompt
Subtopics#
- Enumeration: banner and OS detection.
- Authentication: defaults, no-auth, and brute force.
- Memory corruption: RCE in telnetd implementations.
- Traffic interception: cleartext capture and session hijacking.