> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/enumeration/telnet-23-2323.md).

# Telnet 23 - 2323

Telnet enumeration

**#Banner Grabbing**

With netcat

```
nc -vn 10.10.10.10 23
```

With Telnet

```
telnet 10.10.10.10 23
```

**#NMAP**

```
nmap -n -sV -Pn --script "telnet and safe" -p 23 10.10.10.10
```

**#Metasploit**

```
msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_version; set RHOSTS 10.10.10.10; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/brocade_enable_login; set RHOSTS 10.10.10.10; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_encrypt_overflow; set RHOSTS 10.10.10.10; set RPORT 23; run; exit' && msfconsole -q -x 'use auxiliary/scanner/telnet/telnet_ruggedcom; set RHOSTS 10.10.10.10; set RPORT 23; run; exit'
```

Port 2323 is an alternative port used in IOT devices configured to use telnet

**#Hydra bruteforce users via telnet**

```
sudo hydra -L users.txt -P rockyou.txt 10.10.10.10 telnet -V
```