Skip to content
HackIndex.io

CouchDB Database Enumeration

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

CouchDB is a document-oriented NoSQL database accessible over HTTP on port 5984 (default). The REST API returns JSON for all operations. Enumeration identifies the version, lists databases, and checks whether authentication is required. CouchDB instances are frequently deployed without authentication, exposing the full database contents to anyone who can reach the port.

Version and Server Info

The root endpoint returns the CouchDB version and server information.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:5984/ 
{
  "couchdb": "Welcome",
  "version": "3.3.3",
  "git_sha": "40afbb5e1",
  "uuid": "a1b2c3d4e5f6",
  "features": ["access-ready", "partitioned", "pluggable-storage-engines", "reshard", "scheduler"]
}

A JSON response with version info confirms CouchDB is running and accessible. If it returns 401, authentication is enforced on the root endpoint (but individual endpoints may still be open).

Nmap Detection

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 5984 --script couchdb-databases,couchdb-stats $TARGET_IP 
PORT     STATE SERVICE VERSION
5984/tcp open  http    CouchDB httpd 3.3.3 (Erlang OTP/25)
| couchdb-databases:
|   _global_changes
|   _replicator
|   _users
|   customers
|_  internal_docs
| couchdb-stats:
|   httpd/requests: 1523
|_  httpd/bulk_requests: 42
Explain command
--script couchdb-databases,couchdb-stats Enumerate databases and server statistics.

The databases script lists all databases. Names starting with _ are system databases. Application databases (customers, internal_docs) contain user data.

Database Listing

The /_all_dbs endpoint returns every database on the server.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:5984/_all_dbs | python3 -m json.tool 
[
  "_global_changes",
  "_replicator",
  "_users",
  "customers",
  "internal_docs",
  "secrets"
]

Document Listing

For each database, list all document IDs with /_all_docs. Add ?include_docs=true to retrieve full document contents.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:5984/secrets/_all_docs | python3 -m json.tool 
{
  "total_rows": 3,
  "offset": 0,
  "rows": [
    {"id": "api-key-prod", "key": "api-key-prod", "value": {"rev": "1-abc"}},
    {"id": "db-creds", "key": "db-creds", "value": {"rev": "1-def"}},
    {"id": "ssh-key", "key": "ssh-key", "value": {"rev": "1-ghi"}}
  ]
}

Document IDs often reveal what type of data is stored. Request individual documents or use include_docs=true for bulk extraction.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:5984/secrets/db-creds | python3 -m json.tool

User Enumeration

The _users database stores CouchDB user accounts. If readable, it reveals usernames and password hashes.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:5984/_users/_all_docs?include_docs=true | python3 -m json.tool

User documents contain the name, roles, and a derived_key + salt for PBKDF2 password hashes. Extract the hashes for offline cracking.

Configuration Endpoints

The /_node/_local/_config endpoint exposes server configuration including admin credentials in plaintext on older versions.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:5984/_node/_local/_config | python3 -m json.tool

On CouchDB < 3.0, admin passwords configured through the config API may appear as plaintext or unsalted hashes.

If unauthenticated access is confirmed, continue to CouchDB exploitation for admin creation and remote code execution.

References