Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
PSO - Printer Security Offensive — Offensive security tool for printer pentesting | Kitploit
Tools/GitLabGitLab/hivesecurity/pso-printer-security-offensive
Vulnerability ScannersIoT SecurityExploitationInformation GatheringNetwork SecurityPenetration TestingHardware Security
GitLabhivesecurity/pso-printer-security-offensive

PSO - Printer Security Offensive

Offensive security tool for printer pentesting

View Repository
38 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🖨️ PSO - Printer Security Offensive

Version 0.4.0 | Changelog

"Nmap for Printers" - Offensive security tool for printer pentesting.

Fast. Focused. No bloat.


⚠️ Legal Notice

PSO includes assessment and exploitation features. Always obtain explicit authorization before use.

  • Safe mode: Scanning + IPP queries
  • Aggressive mode (--aggressive): PJL file system exploitation

Unauthorized network scanning is illegal. Use responsibly.


Features

  • ✅ Active Network Scanning - CIDR ranges with custom port support
  • ✅ Port Ranges - Scan 443,631,5000-6000,9100 efficiently
  • ✅ Binary IPP Protocol - Native IPP for accurate printer attributes
  • ✅ PJL Probing - Identifies printers via @PJL INFO ID
  • 🔥 PJL FS Exploit () - Tests unauthenticated file system access
--aggressive
  • ✅ Job Forensics - Lists stored print jobs (metadata only)
  • ✅ CVE Matching - Checks against known vulnerabilities
  • ✅ Risk Scoring - Deterministic scoring (encryption, CVEs, exploitability)
  • ✅ Multiple Outputs - Table, CSV, JSON

  • Installation

    root@kitploit:~
    pip install -r requirements.txt
    

    Requirements: zeroconf, requests, pyyaml


    Quick Start

    Scan Network (Standard Ports)

    root@kitploit:~
    python pso.py --scan 192.168.1.0/24
    

    Scan with Custom Ports

    root@kitploit:~
    # Single port
    python pso.py --scan 10.0.0.0/24 --ports 8631
    
    # Multiple ports
    python pso.py --scan 10.0.0.0/24 --ports 443,631,9100
    
    # Port ranges (smart!)
    python pso.py --scan 10.0.0.0/24 --ports 443,631,5000-6000,9100
    

    Single Target Assessment

    root@kitploit:~
    python pso.py 192.168.1.50 --check-jobs
    

    Aggressive Mode (Exploitation)

    Requires authorization. Enables PJL file system checks.

    root@kitploit:~
    python pso.py 192.168.1.50 --aggressive
    

    Output:

    root@kitploit:~
    [!] AGGRESSIVE MODE ENABLED
    [!] PJL file system checks are EXPLOITATION.
    [!] Ensure you have explicit authorization.
    
    [*] 192.168.1.50 (JETDIRECT)...
      └─ PJL ID: Canon imageRUNNER ADVANCE
      🔥 PJL FS ACCESS CONFIRMED (Exploitable)
    
    Risk: 🔥 CRITICAL (Exploitable)
    

    Parse Nmap Results

    root@kitploit:~
    nmap -p- 10.0.0.0/16 -oX scan.xml
    python pso.py --nmap scan.xml --aggressive --output json
    

    Usage

    Options

    root@kitploit:~
    python pso.py [target] [options]
    
    Positional:
      target                IP or CIDR (e.g., 192.168.1.0/24)
    
    Options:
      --scan CIDR           Scan network range
      --ports PORTS         Ports: single (631), list (443,631,9100), ranges (5000-6000)
      --nmap FILE           Parse nmap XML
      --check-jobs          Check for stored print jobs
      --aggressive          Enable PJL FS checks (requires authorization)
      --output FORMAT       table | csv | json (default: table)
      --timeout SEC         mDNS timeout (default: 5)
      --no-probe            Skip active probing
    

    Examples

    Network scan with custom ports:

    root@kitploit:~
    python pso.py --scan 10.0.0.0/24 --ports 443,631,5000-6000,9100
    

    Comprehensive assessment:

    root@kitploit:~
    python pso.py 192.168.1.50 --check-jobs --aggressive --output json
    

    Automation workflow:

    root@kitploit:~
    # 1. Discovery
    nmap -sV -p- 10.0.0.0/16 -oX scan.xml
    
    # 2. PSO analysis
    python pso.py --nmap scan.xml --aggressive --output json > results.json
    
    # 3. Filter critical findings
    cat results.json | jq '.printers[] | select(.risk_score > 80)'
    

    Port Scanning

    Default ports: 9100, 631, 515, 443 (standard printer ports)

    Why custom ports?

    • Enterprise environments use non-standard ports
    • Security through obscurity configurations
    • Cloud print services
    • Port conflict avoidance

    Syntax:

    root@kitploit:~
    --ports 631                    # Single
    --ports 443,631,9100          # List
    --ports 5000-6000             # Range
    --ports 443,631,5000-6000,9100  # Mixed
    

    Note: For comprehensive scans, use nmap first to discover all open ports, then parse results with PSO.


    Attack Vectors

    1. PJL File System Access (--aggressive)

    What it does:

    • Sends @PJL FSDIRLIST to PJL-enabled ports
    • Lists files/directories on printer storage
    • No authentication required (if vulnerable)

    Impact: 🔥 CRITICAL

    • Enumerate file names and paths
    • Identify sensitive documents
    • Prerequisite for file extraction

    Detection: May trigger IDS/IPS

    Legal: Requires explicit authorization

    2. IPP Job Forensics (--check-jobs)

    What it does:

    • IPP Get-Jobs operation
    • Retrieves stored job metadata

    Impact: 🔴 HIGH

    • Reveals sensitive file names
    • Username attribution
    • Metadata only (no document content)

    Legal: Generally acceptable in authorized pentests


    Output Formats

    Table (Default)

    root@kitploit:~
    Name                 IP              Port   Proto  Make/Model                     Risk   Level          
    ---------------------------------------------------------------------------------------------------------
    Canon-Office         192.168.1.50    631    IPP    Canon imageRUNNER ADVANCE      85     🔥 CRITICAL (Exploitable)
    

    CSV

    root@kitploit:~
    python pso.py --scan 10.0.0.0/24 --output csv > findings.csv
    

    JSON (Automation)

    root@kitploit:~
    python pso.py --scan 10.0.0.0/24 --output json > results.json
    

    JSON structure:

    root@kitploit:~
    {
      "printers": [
        {
          "id": "printer_192_168_1_50",
          "ip": "192.168.1.50",
          "risk_score": 85,
          "risk_level": "🔥 CRITICAL (Exploitable)",
          "fs_access": true,
          "vulnerabilities": [...],
          "findings": [...]
        }
      ]
    }
    

    CVE Database

    PSO checks printers against known vulnerabilities in cve_db/printers.yaml.

    Included CVEs:

    • HP: CVE-2022-3942 (CRITICAL 9.8), CVE-2021-39238 (HIGH 8.8)
    • Canon: CVE-2020-6796 (HIGH 7.5)
    • Xerox: CVE-2021-28673 (CRITICAL 9.1)

    Add your own:

    root@kitploit:~
    vendors:
      YourVendor:
        models:
          "Model XYZ":
            cves:
              CVE-2025-0001:
                severity: CRITICAL
                cvss: 9.8
                description: "Your finding"
                remediation: "Fix steps"
    

    Bulk update:

    root@kitploit:~
    python cve_db_builder.py --export
    

    Pentest Workflow

    root@kitploit:~
    # 1. Discovery
    nmap -sV -p- 10.0.0.0/16 -oX nmap_scan.xml
    
    # 2. Assessment
    python pso.py --nmap nmap_scan.xml --check-jobs --output json > assessment.json
    
    # 3. Exploitation (authorized only)
    python pso.py <target_ip> --aggressive --output json > exploit.json
    
    # 4. Reporting
    python pso.py --nmap nmap_scan.xml --output csv > client_report.csv
    

    Troubleshooting

    ModuleNotFoundError?

    root@kitploit:~
    python -m pip install -r requirements.txt
    

    No printers found?

    • Check firewall rules
    • Try custom ports: --ports 8631,19100
    • Use nmap first for discovery

    Contributing

    Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

    License

    MIT - Copyright © 2025 Hivesecurity

    Original Code

    WWW: https://hivesecurity.gitlab.io/ REPO: https://gitlab.com/hivesecurity/pso-printer-security-offensive

    Download Tool