content: How to print stuff out to random printers remotely using Nmap: An example of why certain ports should be closed I've been messing around with Nmap for the past couple of weeks. Up until today, I hadn't really figured out how to do anything useful besides checking for open ports, running very basic scripts and checking OS/traceroute. If you don't know what Nmap is, it is basically a port scanner that allows you to scan IP addresses, get information from them and also run scripts against IPs you are scanning (they have a library of some 500+ scripts at this point, but you can also write your own). A couple of hours ago, I had the idea of trying to scan for a bunch of random IPs with certain ports open that may indicate that the IPs belong to printers, and then trying to connect to said printer and make it print something out. Luckily, I discovered that Nmap already has a pre-written script that will print something to a printer if a certain port is open - I chose port 9100. Port 9100 (if open) can receive raw print text through a TCP connection, which (if the device is actually a printer) the printer will print out as soon as the connection is closed. This basically means you can print out any text you would like if you have the IP of a printer that has the port open. Obviously the printer needs to be turned on and have the things it needs to physically print out the text or it won't work. If you're going to try this with a printer you own/have access to/know the IP of, skip this bit and go down to the next section.  Disclaimer: I only recommend doing this with printers you own or have access to, do not start printing random shit to different IP addresses. However, if you did want to do that, this is how you might do it. Bear in mind that I have only been messing around with this for a couple of weeks and there is probably a much better and faster command/script for doing this. You want to search for some random IPs, and check if they have port 9100 open. This command checks 1000 random IPs and displays ones that have port 9100 open: Note that you can also add a command to put the output that this scan gives into a file. The file can then be used to grab all the IPs, and specify them as targets in the next scan with the command -iL whateverthefuckyoucalledthefile.txt I will not go into this however as it is incredibly boring and I don't want to spend time on it. If you want to do this, look at the command help list with "nmap -h" or look up a guide online. I will instead show you what to do to further verify that a target IP is probably a printer. I will show you how to do this using a fake IP as an example: This will return information on the operating system and services of the IP, and will give you a closer hint as to whether it is a printer or not. Doing this scan with hundreds or thousands of different IPs might take a while. In my case, I was lucky with this. I found an IP with the port open, and also had a big chance of being a printer based on the second scan. I put the IP into my browser just to see what would come up, and I discovered that the printer actually had an online interface of sorts where you could log in to it and see all of the stuff that had been printed out. The command you will need to print to a printer is as follows: When the script has finished, you will get an output that looks something like this: As I also had access to the interface, I can show you what this looked like from the other side: Here is me starting up the command: Note the time - 02:41 GMT. The target printer was on the US west coast, so there is a -8 hour time difference, but here is the printer log recording my message being printed out just after I ran the command. CLOSE YOUR FUCKING PORTS. I have almost zero knowledge about this and I was able to print something out remotely, and also look at the printer from the other side. Scarily, there was a lot more information there than a print log, and I didn't even have admin or user access yet I was still able to look at it, and even delete things from the printer log, check toner and paper levels and all sorts of other stuff.