Default Port: 8089
Splunkd is the core component of the Splunk platform, responsible for indexing, searching, and processing data ingested by Splunk. It provides a web interface and APIs for managing and analyzing machine-generated data.
Splunk is widely used for log management, security information and event management (SIEM), and data analytics in enterprise environments.
Connect
Connect Using Web Interface
You can access the Splunk web interface by navigating to https://<splunk-server-ip>:8089 in a web browser.
Connect Using Splunk CLI
Splunk CLI commands can be used for various administrative tasks and querying data. You can connect to Splunk using the following command:
splunk login -auth <username>:<password> -port 8089 -host <splunk-server-ip>
Recon
Identifying a Splunk Server
You can use Nmap to check if there's a Splunk server running on a target host like this:
nmap -p 8089 X.X.X.X
Banner Grabbing
You can use tools like Netcat to perform banner grabbing and retrieve information about the Splunk service:
nc -nv X.X.X.X 8089
Enumeration
Splunkd API Endpoints
Splunkd exposes various API endpoints for interacting with the Splunk platform. You can enumerate these endpoints to gather information about the server and available functionalities.
Attack Vectors
Default Credentials
Check for default credentials or weak authentication configurations in Splunk instances, such as admin:admin or admin:<blank>.
Unauthorized Access
Exploit misconfigured access controls or weak authentication mechanisms to gain unauthorized access to sensitive data stored in Splunk.
Post-Exploitation
Common Splunk CLI Commands
Command| Description
---|---
splunk search <query>| Perform a search query in Splunk.
splunk list <entity>| List entities like indexes, sources, or sourcetypes.
splunk info <entity>| Display detailed information about a specific entity.
splunk add <entity> <name>| Add a new entity to Splunk (e.g., index, input).
splunk delete <entity> <name>| Delete an existing entity from Splunk.
Data Manipulation
Manipulate indexed data in Splunk, such as modifying or deleting events, altering timestamps, or injecting fake data.