/xmpp-enumeration

name: xmpp-enumeration
description: >
  XMPP/Jabber service enumeration for Openfire, ejabberd, Prosody, and other
  XMPP servers. Trigger when ports 5222 (client), 5223 (legacy TLS), or 5269
  (server-to-server) are found open. Covers authentication testing, user
  enumeration, MUC room discovery, and server fingerprinting. Do NOT use for
  AD enumeration or credential spraying — route those to the appropriate skills.
keywords:
  - xmpp
  - jabber
  - openfire
  - ejabberd
  - prosody
  - "5222"
  - "5223"
  - "5269"
  - xep-0077
  - sasl
  - anonymous
  - muc
  - in-band registration
  - chat
  - instant messaging
tools:
  - python3
  - nmap
opsec: low

XMPP/Jabber Enumeration

You are helping a penetration tester enumerate an XMPP/Jabber service. This skill covers service detection, authentication testing, user enumeration, MUC (Multi-User Chat) room discovery, and server fingerprinting. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[xmpp-enumeration] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `xmpp-users.txt`, `xmpp-rooms.txt`, `xmpp-server-info.txt`).

Scope Boundary

This skill covers XMPP service enumeration only. It does NOT cover:

• AD enumeration or Kerberos attacks — route to **ad-discovery**
• Credential spraying or brute force — route to **password-spraying**
• Web application testing (even Openfire admin console) — route to **web-discovery**
• Exploitation of RCE vulnerabilities in XMPP servers — report and return

When enumeration is complete, STOP and return to the orchestrator with discovered users, rooms, server details, and recommendations for next skills.

**Stay in methodology.** Only use techniques documented in this skill. If you encounter a scenario not covered here, note it and return — do not improvise attacks, write custom exploit code, or apply techniques from other domains. The orchestrator will provide specific guidance or route to a different skill.

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• XMPP port open: 5222 (STARTTLS), 5223 (legacy TLS), or 5269 (S2S)
• **python3** — for raw XML socket interaction (no external libraries required)
• **nmap** — for initial service probing (via MCP nmap-server)
• Optional: `slixmpp` Python library (if installed, simplifies some steps)

Special characters in credentials

Bash history expansion treats `!` as a special character (`!event`), even inside double quotes. Passwords containing `!`, `$`, backticks, or other shell metacharacters will be silently mangled when passed as command arguments.

**Canonical workaround** — write to file, read from file:

# 1. Use the Write tool (not echo/printf) to create a password file
Write("/tmp/claude-1000/cred.txt", "lDaP_1n_th3_cle4r!")

# 2. Read into a variable
PASS=$(cat /tmp/claude-1000/cred.txt)

# 3. Use the variable in commands (double-quote it)
python3 xmpp_enum.py --password "$PASS"

Step 1: Service Detection

Confirm XMPP service and identify the server software.

1a. Nmap Service Probes

Use the nmap MCP to scan XMPP ports:

nmap_scan(target="<IP>", options="-sV -p 5222,5223,5269,5270,5275,5276,7070,7443,9090,9091 -sC")

Key ports: | Port | Service | Notes | |------|---------|-------| | 5222 | XMPP client (STARTTLS) | Primary client connection | | 5223 | XMPP client (legacy TLS) | Direct TLS, older servers | | 5269 | XMPP server-to-server | Federation port | | 5270 | XMPP S2S (TLS) | Secure federation | | 5275 | XMPP component | External component interface | | 7070 | HTTP binding (BOSH) | Web client access | | 7443 | HTTPS binding (BOSH) | Secure web client access | | 9090 | Openfire admin (HTTP) | Admin console — route to **web-discovery** | | 9091 | Openfire admin (HTTPS) | Admin console — route to **web-discovery** |

1b. TLS Certificate Inspection

Extract hostname and organization from the TLS certificate:

# STARTTLS on 5222
echo | openssl s_client -starttls xmpp -connect <IP>:5222 -servername <domain> 2>/dev/null | openssl x509 -noout -subject -issuer -dates

# Direct TLS on 5223
echo | openssl s_client -connect <IP>:5223 2>/dev/null | openssl x509 -noout -subject -issuer -dates

The certificate CN or SAN fields often reveal the XMPP domain (e.g., `chat.corp.local`, `xmpp.target.local`).

1c. Raw XMPP Stream Probe

Send an initial stream header to identify the server and supported features:

#!/usr/bin/env python3
"""XMPP stream probe — identifies server software and SASL mechanisms."""
import socket
import ssl
import sys

TARGET = sys.argv[1]  # IP or hostname
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 5222
DOMAIN = sys.argv[3] if len(sys.argv) > 3 else TARGET

STREAM_HEADER = f'''<?xml version='1.0'?>
<stream:stream xmlns='jabber:client'
  xmlns:stream='http://etherx.jabber.org/streams'
  to='{DOMAIN}' version='1.0'>'''

def probe(target, port, domain, use_tls=False):
    sock = socket.create_connection((target, port), timeout=10)
    if use_tls:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        sock = ctx.wrap_socket(sock, server_