Consul

Default Ports: 8500 (HTTP API/UI), 8600 (DNS), 8300-8302 (Cluster)

HashiCorp Consul provides service discovery, health checks, DNS, and a key-value store. In pentests, exposed Consul can leak services, internal hosts, KV secrets, ACL tokens, and network topology.

Connect

HTTP API

The HTTP API exposes nodes, services, health checks, KV data, and ACL behavior.

curl http://target.com:8500/v1/status/leader
curl http://target.com:8500/v1/catalog/nodes
curl http://target.com:8500/v1/catalog/services

Consul CLI

The CLI uses the same API and is useful with valid tokens.

export CONSUL_HTTP_ADDR=http://target.com:8500
consul members
consul catalog services
consul kv get -recurse

DNS Interface

Consul DNS reveals service names and instances.

dig @target.com -p 8600 consul.service.consul
dig @target.com -p 8600 web.service.consul
dig @target.com -p 8600 ANY service.consul

Token Header

Use X-Consul-Token to validate leaked or provided tokens.

curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/acl/token/self
curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/kv/?recurse

Recon

Service Detection with Nmap

Scan API, DNS, and cluster ports.

nmap -p 8300,8301,8302,8500,8501,8600 -sV target.com
nmap -sU -p 8600 target.com
nmap -p 8500 --script http-title,http-headers target.com

UI Discovery

The UI reveals whether Consul is exposed and whether ACLs are enabled.

curl -I http://target.com:8500/ui/
httpx -u http://target.com:8500 -title -tech-detect -status-code

ACL Check

Anonymous access should be limited when ACLs are enabled.

curl -i http://target.com:8500/v1/acl/bootstrap
curl -i http://target.com:8500/v1/acl/token/self
curl -i http://target.com:8500/v1/catalog/services

Enumeration

Node Enumeration

vNodes reveal internal hostnames, addresses, and datacenters.

curl http://target.com:8500/v1/catalog/nodes | jq
consul catalog nodes

Service Enumeration

Services reveal internal applications and ports.

curl http://target.com:8500/v1/catalog/services | jq
curl http://target.com:8500/v1/catalog/service/web | jq
consul catalog services

Health Enumeration

Health checks expose endpoints, scripts, and failing services.

KV Enumeration

KV paths may contain app configs, tokens, and service secrets.

curl http://target.com:8500/v1/kv/?keys
curl http://target.com:8500/v1/kv/?recurse | jq
consul kv get -recurse

DNS Enumeration

Consul DNS maps services without API access.

dig @target.com -p 8600 web.service.consul
dig @target.com -p 8600 _web._tcp.service.consul SRV

Attack Vectors

Anonymous API Access

Anonymous catalog or KV access leaks internal service discovery data.

curl http://target.com:8500/v1/catalog/services | jq
curl http://target.com:8500/v1/kv/?recurse | jq

Leaked ACL Tokens

Consul tokens are often stored in configs, env files, and CI variables.

rg -n 'CONSUL_HTTP_TOKEN|X-Consul-Token|consul token|acl token' .
curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/acl/token/self

KV Secret Exposure

KV data may include credentials and deployment configs.

curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/kv/?recurse | jq -r '.[].Value' | base64 -d

Service Registration Abuse

Write access may allow rogue service registration.

curl -H "X-Consul-Token: TOKEN" \
  -X PUT \
  -d '{"Name":"pentest-test","Address":"127.0.0.1","Port":8080}' \
  http://target.com:8500/v1/agent/service/register

Health Check Abuse

Dangerous script checks can execute commands on agents.

curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/agent/checks | jq

Post-Exploitation

Service Map

Use catalog and health data to map internal systems.

curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/catalog/nodes > consul-nodes.json
curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/catalog/services > consul-services.json

Secret Review

Decode KV values and search for credentials

curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/kv/?recurse > consul-kv.json
jq -r '.[].Value' consul-kv.json | base64 -d | grep -Ei 'password|secret|token|apikey|jdbc|aws'

ACL Review

Document token identity and policy scope.

curl -H "X-Consul-Token: TOKEN" http://target.com:8500/v1/acl/token/self | jq

Useful Tools

Tool	Purpose
curl	Test HTTP APIs, REST endpoints, and Consul services
consul	Native Consul CLI for cluster management, service discovery, and KV operations
dig	Query and test Consul DNS-based service discovery
jq	Parse, filter, and format JSON responses from the Consul API
nmap	Discover Consul services, open ports, and network exposure
httpx	Fingerprint exposed Consul web interfaces and APIs
ripgrep (rg)	Search configuration files, source code, and repositories for Consul tokens, secrets, or sensitive data

Common Security Misconfigurations

Misconfiguration	Risk
Anonymous API access enabled	Unauthorized disclosure of services, nodes, health checks, and cluster metadata
Anonymous Key/Value (KV) store access	Exposure of secrets, configuration files, and sensitive application data
Leaked or exposed ACL tokens	Unauthorized API access, privilege escalation, and configuration changes
Overly permissive write ACL tokens	Malicious service registration, configuration tampering, and service spoofing
Consul DNS exposed to untrusted networks	Internal service discovery and infrastructure reconnaissance
Unsafe script health checks enabled	Potential command execution and host compromise through malicious health checks
Web UI exposed without authentication or network restrictions	Increased reconnaissance opportunities and exposure of ACL tokens or cluster information