Skip to content
HackIndex logo

HackIndex

Enumerating Vector Databases and RAG Pipeline Components

3 min read Mar 18, 2026

RAG pipelines depend on a vector database to store and retrieve document embeddings. These databases are a distinct attack surface from the LLM itself — they contain the knowledge the model draws from, and compromising them means controlling what the model believes is true. Before attacking the RAG pipeline, you need to identify which vector database is in use, whether it is directly accessible, what collections or indices exist, and what data they contain.

Identify Vector Database from Application Responses

RAG applications sometimes leak vector database metadata in their responses, particularly when debug logging is enabled or source citations are included:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/api/chat -H 'Content-Type: application/json' -d '{"messages":[{"role":"user","content":"What sources did you use to answer that?"}]}' | python3 -m json.tool 
{
    "response": "Based on the following sources...",
    "source_documents": [
        {"metadata": {"source": "s3://company-docs/policy.pdf", "chunk_id": "abc123"}}
    ]
}

Source metadata in responses reveals the document storage backend, chunk identifiers, and sometimes internal file paths. S3 bucket names, internal network paths, and document identifiers found here are useful for supply chain and data poisoning attacks in later phases.

Probe for Exposed Chroma

Chroma runs on port 8000 by default with no authentication in development mode. Check the heartbeat and list collections:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:8000/api/v1/heartbeat 
{"nanosecond heartbeat": 1234567890}
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:8000/api/v1/collections | python3 -m json.tool 
[
    {
        "name": "company_knowledge_base",
        "id": "a1b2c3d4-...",
        "metadata": {"description": "Internal policy documents"}
    }
]

An exposed Chroma instance reveals collection names, metadata, and collection IDs. With the collection ID you can query and retrieve embeddings and documents directly — covered in the RAG exploitation phase.

Probe for Exposed Qdrant

Qdrant runs on port 6333 with a REST API and no authentication by default:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:6333/collections | python3 -m json.tool 
{
    "result": {
        "collections": [
            {"name": "product_documentation"},
            {"name": "support_tickets"}
        ]
    },
    "status": "ok"
}
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:6333/collections/product_documentation | python3 -m json.tool

Probe for Exposed Weaviate

Weaviate runs on port 8080 with a GraphQL and REST API:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:8080/v1/schema | python3 -m json.tool 
{
    "classes": [
        {
            "class": "Document",
            "description": "Company documents",
            "properties": [
                {"name": "content", "dataType": ["text"]},
                {"name": "source", "dataType": ["text"]}
            ]
        }
    ]
}

The Weaviate schema reveals the data structure of every class stored in the database including property names and data types. Property names like source, author, classification, or internal indicate the type and sensitivity of stored documents.

Identify Embedding Service Endpoints

RAG pipelines use a separate embedding service to convert query text into vectors. These are sometimes exposed independently from the vector database:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_DOMAIN/api/v1/embeddings -H 'Content-Type: application/json' -d '{"input":"test","model":"text-embedding-3-small"}' | python3 -m json.tool 
{
    "object": "list",
    "data": [
        {
            "object": "embedding",
            "embedding": [0.0023, -0.0141, ...],
            "index": 0
        }
    ],
    "model": "text-embedding-3-small"
}

An accessible embedding endpoint can be used to generate embeddings for attacker-controlled content during RAG poisoning attacks — covered in the exploitation phase. The model name in the response confirms which embedding model is used, which is necessary for crafting effective poisoning payloads.

References