{
  "port": 9191,
  "protocol": "tcp",
  "service": "PaperCut admin UI (registered as Sun AppSvr JPDA)",
  "oneLiner": "Almost always the PaperCut print-management web console, despite the Java-debugger registration.",
  "whatItIs": "IANA registered 9191 in 2005 as sun-as-jpda, the Java Platform Debugger Architecture port for Sun's application server, and scanners still print that name. In the field the port belongs to PaperCut NG/MF, whose Application Server serves its admin and end-user web interface on 9191 over HTTP with 9192 as the HTTPS counterpart; print servers and workstation clients also talk to it. A listener on 9191 in an office almost always means a PaperCut server.",
  "exposure": {
    "verdict": "never",
    "note": "It is a cleartext HTTP admin console for print accounting, user balances, and server configuration. Use the 9192 HTTPS port and keep both off the public internet; a JPDA debug port would be even worse, since JDWP grants code execution with no authentication."
  },
  "checkCommand": "curl -sS -m 5 -o /dev/null -w '%{http_code}\\n' http://TARGET:9191/",
  "links": [
    {
      "title": "IANA port registry — 9191 (sun-as-jpda)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9191",
      "kind": "iana"
    },
    {
      "title": "PaperCut NG/MF — Change the Application Server ports",
      "url": "https://www.papercut.com/help/manuals/ng-mf/common/sys-security-options-change-ports/",
      "kind": "official-docs"
    }
  ]
}