How to search for all computers running memcached on shodan

Question

Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port 11211. A client software (such as web server) can make get and set queries to memcached server. As clients can store sensitive information in Memcached, it is not advisable to connect Memcached servers to internet.

For my research, I would like to search the active memcached servers that are connected to internet. A simple search query on shodan.io would be "port:11211". As I only want "active" memcached servers, I want to list the servers which store more than 1000 items (cur_items > 1000). May I know how to query shodan?

Answer 1

Shodan sends the STATS command and that information can be seen in the Memcached banner and metadata:

https://www.shodan.io/search?query=product%3Amemcached

You can use that information to see the number of stored items though we don't allow filtering by that information via the API/ website so you need to download the search results to process it locally.

Answer 2

To get information about the number items you could use the STATS command after connecting to a memcached instance. Shodan doesn't run commands against all the servers it scans, rather it makes simple connections and records the response.

You can't connect to random machines and start running commands, that's not legal. I mention this because the way you worded your question it sounds like you're attempting to enumerate memcached servers to use in reflected DDOS attacks.