# Cassandra

> Cassandra is a distributed NoSQL database. Attackers probe open ports, enumerate keyspaces, exploit misconfigs or weak auth, extract data, and pivot using stolen credentials

- **URL:** https://hackindex.io/services/cassandra
- **Type:** Service
- **Default ports:** 9042, 9160
- **Tags:** nosql, database, cassandra, network, enumeration, credentials
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

Apache Cassandra is a distributed NoSQL database designed for high availability and scalability. The CQL (Cassandra Query Language) native transport listens on **TCP port 9042**, and internode cluster communication uses **TCP port 7000** (or 7001 for TLS). Nmap may identify port 9042 as `cassandra` depending on detection scripts.

Cassandra instances are often deployed without authentication enabled, especially in development and internal environments. Unauthenticated access to the CQL port grants full read and write control over all keyspaces and tables. Even when authentication is enabled, default credentials (`cassandra:cassandra`) are frequently left unchanged. The distributed nature of Cassandra means compromising one node can expose data replicated across the entire cluster.

Enumeration starts with connecting via `cqlsh` to test for unauthenticated or default-credential access. Listing keyspaces (`DESCRIBE KEYSPACES`) and tables reveals the data model and scope of stored information. System tables expose cluster topology, node addresses, and configuration details. The JMX management interface (typically on port 7199) provides additional attack surface for monitoring and management operations if accessible.

## Phases

- [Enumeration](https://hackindex.io/services/cassandra/enumeration.md): Enumerate Cassandra via cqlsh to extract keyspaces and hashes (1 guides)
- [Exploitation](https://hackindex.io/services/cassandra/exploitation.md): Exploit open Cassandra via cqlsh, backdoor users, dump data, run OS command (1 guides)