PRTG Discovery & Enumeration

Network Discovery

PRTG typically listens on common web ports and is easily discovered via Nmap service detection:

Common Ports

• 80 (HTTP)
• 443 (HTTPS)
• 8080 (Default alternative port)
• Custom ports may be configured in Setup > System Administration

Nmap Discovery

sudo nmap -sV -p- --open -T4 <target>

Look for: Indy httpd with mention of Paessler PRTG bandwidth monitor

Example output:

PORT     STATE SERVICE       VERSION
8080/tcp open  http          Indy httpd 17.3.33.2830 (Paessler PRTG bandwidth monitor)

Version Detection

curl -s http://<target>:8080/index.htm -A "Mozilla/5.0 (compatible; MSIE 7.01; Windows NT 5.0)" | grep version

Look for lines like:

<span class="prtgversion">&nbsp;PRTG Network Monitor 17.3.33.2830 </span>

Web Interface Fingerprinting

Login Page

Browse to the identified PRTG URL (typically http://target:8080/index.htm):

• Clean login page with clear PRTG branding
• Version information often visible in HTML source
• Default credentials frequently pre-filled: prtgadmin:prtgadmin
• Company branding (Paessler logo and blog links)

Default Credentials

Common default credentials to try:

• prtgadmin:prtgadmin (often still active)
• admin:admin
• Vendor-specific variations

Automated Detection

Vulnerability Scanners

Tools with PRTG detection plugins:

• Nessus - has specific PRTG plugins
• OpenVAS - generic HTTP detection
• Qualys - can detect PRTG versions

Screen Capture Tools

• EyeWitness - identifies PRTG and often shows default credentials on login page
• Shodan - can identify exposed PRTG instances (though rare externally)

Initial Access Testing

Default Credential Testing

If default credentials prtgadmin:prtgadmin fail, attempt:

1. Multiple password variations based on password policies
2. Year-based passwords (e.g., prtgadmin2021, prtgadmin2022)
3. Default credentials for the organization (company name + common suffixes)
4. Environmental reconnaissance for typical passwords

Authentication Bypass

• No known public authentication bypass for modern versions
• Focus on credential discovery or brute force approaches
• Monitor for account lockout policies

Recon During Authenticated Access

Once logged in (or if login is bypassed), gather information:

1. Dashboard: View monitored devices and network topology
2. Setup > System Administration: Access configuration and version info
3. Setup > Account Settings: User management and notification settings
4. Devices: List of monitored hosts and sensors
5. Reports: Data collection and monitoring patterns