> For the complete documentation index, see [llms.txt](https://angelica.gitbook.io/hacktricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://angelica.gitbook.io/hacktricks/network-services-pentesting/9100-pjl.md). # 9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream) {% hint style="success" %} Learn & practice AWS Hacking:

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Learn & practice GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Support HackTricks

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

{% endhint %} ## Basic Information From [here](http://hacking-printers.net/wiki/index.php/Port_9100_printing): Raw printing is what we define as the process of making a connection to port 9100/tcp of a network printer. It is the default method used by CUPS and the Windows printing architecture to communicate with network printers as it is considered as ‘*the simplest, fastest, and generally the most reliable network protocol used for printers*’. Raw port 9100 printing, also referred to as JetDirect, AppSocket or PDL-datastream actually **is not a printing protocol by itself**. Instead **all data sent is directly processed by the printing device**, just like a parallel connection over TCP. In contrast to LPD, IPP and SMB, this can send direct feedback to the client, including status and error messages. Such a **bidirectional channel** gives us direct **access** to **results** of **PJL**, **PostScript** or **PCL** commands. Therefore raw port 9100 printing – which is supported by almost any network printer – is used as the channel for security analysis with PRET and PFT. If you want to learn more about [**hacking printers read this page**](http://hacking-printers.net/wiki/index.php/Main_Page). **Default port:** 9100 ``` 9100/tcp open jetdirect ``` ## Enumeration ### Manual ```bash nc -vn 9100 @PJL INFO STATUS #CODE=40000 DISPLAY="Sleep" ONLINE=TRUE @PJL INFO ID # ID (Brand an version): Brother HL-L2360D series:84U-F75:Ver.b.26 @PJL INFO PRODINFO #Product info @PJL FSDIRLIST NAME="0:\" ENTRY=1 COUNT=65535 #List dir @PJL INFO VARIABLES #Env variales @PJL INFO FILESYS #? @PJL INFO TIMEOUT #Timeout variables @PJL RDYMSG #Ready message @PJL FSINIT @PJL FSDIRLIST @PJL FSUPLOAD #Useful to upload a file @PJL FSDOWNLOAD #Useful to download a file @PJL FSDELETE #Useful to delete a file ``` ### Automatic ```bash nmap -sV --script pjl-ready-message -p ``` ```bash msf> use auxiliary/scanner/printer/printer_env_vars msf> use auxiliary/scanner/printer/printer_list_dir msf> use auxiliary/scanner/printer/printer_list_volumes msf> use auxiliary/scanner/printer/printer_ready_message msf> use auxiliary/scanner/printer/printer_version_info msf> use auxiliary/scanner/printer/printer_download_file msf> use auxiliary/scanner/printer/printer_upload_file msf> use auxiliary/scanner/printer/printer_delete_file ``` ### Printers Hacking tool This is the tool you want to use to abuse printers: {% embed url="" %} ## **Shodan** * `pjl port:9100` {% hint style="success" %} Learn & practice AWS Hacking:

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Learn & practice GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Support HackTricks

{% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://angelica.gitbook.io/hacktricks/network-services-pentesting/9100-pjl.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.