{
  "port": 631,
  "protocol": "tcp",
  "service": "IPP / CUPS",
  "oneLiner": "The Internet Printing Protocol — a printer, or the CUPS print server on a Mac or Linux box.",
  "whatItIs": "IPP is HTTP with a binary message body: clients POST operations like Print-Job and Get-Printer-Attributes to an ipp:// URL, and RFC 8010 requires printers to support HTTP on the IANA-assigned well-known port 631. CUPS, the print system on macOS and most Linux distributions, listens here for both printing and its web administration interface at http://localhost:631/. Nearly every AirPrint or IPP Everywhere network printer answers on 631 as well, which makes it one of the most common open ports on an office LAN.",
  "exposure": {
    "verdict": "careful",
    "note": "Fine on a trusted LAN, where it is designed to live. Exposed publicly it leaks the print queue and device details and hands strangers the CUPS admin interface and a print-job submission path — bind CUPS to localhost or the local subnet."
  },
  "checkCommand": "curl -sI http://TARGET:631/",
  "links": [
    {
      "title": "RFC 8010 — IPP/1.1: Encoding and Transport (well-known port 631)",
      "url": "https://www.rfc-editor.org/rfc/rfc8010.html",
      "kind": "spec"
    },
    {
      "title": "RFC 8011 — IPP/1.1: Model and Semantics",
      "url": "https://www.rfc-editor.org/rfc/rfc8011.html",
      "kind": "spec"
    },
    {
      "title": "OpenPrinting CUPS",
      "url": "https://github.com/OpenPrinting/cups",
      "kind": "github"
    }
  ]
}