SonarQube
Default Port: 9000
SonarQube is a source code quality and security analysis platform. In pentests, exposed SonarQube instances can reveal project names, vulnerable code paths, source snippets, developer users, CI tokens, webhooks, and repository integrations.
Connect
Using Web Browser
Check the UI for anonymous project visibility and authentication method.
http://target.com:9000
https://sonarqube.target.com
https://sonar.target.com
Using curl
Use API endpoints to fingerprint the instance and test anonymous access.
curl -I http://target.com:9000/
curl -s http://target.com:9000/api/system/status
curl -s http://target.com:9000/api/server/version
Using API Token
Leaked SonarQube tokens are commonly found in CI variables and scanner configs.
curl -u TOKEN: http://target.com:9000/api/authentication/validate
curl -u TOKEN: http://target.com:9000/api/projects/search
curl -u TOKEN: http://target.com:9000/api/users/current
Using sonar-scanner
Scanner configuration often exposes host URLs, project keys, and tokens.
sonar-scanner \
-Dsonar.host.url=http://target.com:9000 \
-Dsonar.projectKey=project-key \
-Dsonar.login=TOKEN
Recon
Service Detection with Nmap
Scan the default port and common reverse proxy ports.
nmap -p 80,443,9000,9443 -sV target.com
nmap -p 80,443,9000 --script http-title,http-headers target.com
nmap -p 443,9443 --script ssl-cert,ssl-enum-ciphers target.com
Product Fingerprinting
Version and status endpoints help confirm SonarQube.
curl -s http://target.com:9000/api/system/status
curl -s http://target.com:9000/api/server/version
curl -s http://target.com:9000/api/webservices/list | head
httpx -u http://target.com:9000 -title -tech-detect -status-code
Authentication Review
Check anonymous session behavior before credential testing.
curl -I http://target.com:9000/sessions/new
curl -s http://target.com:9000/api/authentication/validate
curl -s http://target.com:9000/api/users/current
API Discovery
SonarQube exposes an API index when webservices are reachable.
curl -s http://target.com:9000/api/webservices/list | jq
curl -s http://target.com:9000/api/webservices/list | grep -i "projects\|issues\|components\|sources"
Enumeration
Project Enumeration
Anonymous project access is the highest-value first check.
curl -s http://target.com:9000/api/projects/search | jq
curl -s "http://target.com:9000/api/projects/search?q=api" | jq
curl -s "http://target.com:9000/api/components/search?qualifiers=TRK" | jq
Branch and Measure Enumeration
Branches and metrics reveal release flows and vulnerable project areas.
curl -s "http://target.com:9000/api/project_branches/list?project=project-key" | jq
curl -s "http://target.com:9000/api/project_tags/search?project=project-key" | jq
curl -s "http://target.com:9000/api/measures/component?component=project-key&metricKeys=vulnerabilities,bugs,code_smells,ncloc" | jq
Issue Enumeration
Issues may disclose vulnerable files, rule names, severities, and remediation notes.
curl -s "http://target.com:9000/api/issues/search?componentKeys=project-key&types=VULNERABILITY" | jq
curl -s "http://target.com:9000/api/issues/search?componentKeys=project-key&severities=CRITICAL,BLOCKER" | jq
curl -s "http://target.com:9000/api/hotspots/search?projectKey=project-key" | jq
Source Enumeration
Source endpoints may expose snippets or full files depending on permissions.
curl -s "http://target.com:9000/api/components/tree?component=project-key&qualifiers=FIL" | jq
curl -s "http://target.com:9000/api/sources/show?key=project-key:path/to/file.java" | jq
curl -i "http://target.com:9000/api/sources/raw?key=project-key:path/to/file.java"
User and Group Enumeration
User data helps identify developers, admins, and service accounts.
curl -s "http://target.com:9000/api/users/search" | jq
curl -s "http://target.com:9000/api/user_groups/search" | jq
curl -s "http://target.com:9000/api/permissions/users?permission=admin" | jq
Attack Vectors
Anonymous Project Access
Anonymous visibility can leak code intelligence without credentials.
curl -s http://target.com:9000/api/projects/search | jq
curl -s "http://target.com:9000/api/issues/search?types=VULNERABILITY" | jq
curl -i "http://target.com:9000/api/sources/show?key=project-key:path/to/file"
Default Credentials
Check weak local credentials only when in scope.
# Common legacy default:
# admin:admin
curl -u admin:admin http://target.com:9000/api/authentication/validate
Leaked Tokens
Tokens can provide project, issue, source, or admin access.
rg -n 'sonar.login|sonar.token|SONAR_TOKEN|sonar.host.url' .
curl -u TOKEN: http://target.com:9000/api/users/current
curl -u TOKEN: http://target.com:9000/api/projects/search
Source and Secret Exposure
Search accessible issues and source snippets for secrets.
curl -s "http://target.com:9000/api/issues/search?componentKeys=project-key" | grep -Ei 'password|secret|token|apikey'
curl -s "http://target.com:9000/api/sources/show?key=project-key:path/to/file" | grep -Ei 'password|secret|token|apikey'
Webhook and Integration Exposure
Administrative access may reveal CI/CD and repository integrations.
curl -u TOKEN: "http://target.com:9000/api/webhooks/list?project=project-key" | jq
curl -u TOKEN: "http://target.com:9000/api/settings/values?component=project-key" | jq
Post-Exploitation
Project Impact Review
Summarize visible projects, branches, issues, and source access.
curl -u TOKEN: http://target.com:9000/api/projects/search > sonarqube-projects.json
curl -u TOKEN: "http://target.com:9000/api/issues/search?types=VULNERABILITY" > sonarqube-vulnerabilities.json
CI/CD Pivot Review
Project names, scanner configs, and webhooks often point to build systems.
rg -n 'jenkins|gitlab|github|azure|bitbucket|nexus|artifactory|registry' sonarqube-*.json
curl -u TOKEN: "http://target.com:9000/api/webhooks/list" | jq
Account Review
Document users, groups, and admin permissions.
curl -u TOKEN: "http://target.com:9000/api/users/search" > sonarqube-users.json
curl -u TOKEN: "http://target.com:9000/api/user_groups/search" > sonarqube-groups.json
curl -u TOKEN: "http://target.com:9000/api/permissions/users?permission=admin" > sonarqube-admins.json
Useful Tools
Tool| Purpose
---|---
curl| API and auth testing
jq| JSON parsing
httpx| Web fingerprinting
sonar-scanner| Scanner config validation
rg| Token and config searching
nmap| Port and TLS checks
Security Misconfigurations
Misconfiguration| Risk
---|---
Anonymous project access| Project and issue disclosure
Source endpoints exposed| Code and secret leakage
Default or weak local credentials| Administrative access
Leaked scanner tokens| API access through CI secrets
Broad project permissions| Cross-team data exposure
Webhooks visible to low-privilege users| CI/CD integration leakage
Outdated SonarQube| Known vulnerability exposure