# CouchDB Database Enumeration

> Enumerate CouchDB instances via HTTP API to discover databases, documents, users, and configuration details using curl and specialized tools.

- **URL:** https://hackindex.io/services/couchdb/enumeration/couchdb-database-enumeration
- **Path:** CouchDB > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/couchdb/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

CouchDB is a document-oriented NoSQL database accessible over HTTP on port 5984 (default). The REST API returns JSON for all operations. Enumeration identifies the version, lists databases, and checks whether authentication is required. CouchDB instances are frequently deployed without authentication, exposing the full database contents to anyone who can reach the port.

## Version and Server Info

The root endpoint returns the CouchDB version and server information.

```bash
curl -s http://$TARGET_IP:5984/
# {
#   "couchdb": "Welcome",
#   "version": "3.3.3",
#   "git_sha": "40afbb5e1",
#   "uuid": "a1b2c3d4e5f6",
#   "features": ["access-ready", "partitioned", "pluggable-storage-engines", "reshard", "scheduler"]
# }
```

## Nmap Detection

```bash
nmap -sV -p 5984 --script couchdb-databases,couchdb-stats $TARGET_IP
# PORT     STATE SERVICE VERSION
# 5984/tcp open  http    CouchDB httpd 3.3.3 (Erlang OTP/25)
# | couchdb-databases:
# |   _global_changes
# |   _replicator
# |   _users
# |   customers
# |_  internal_docs
# | couchdb-stats:
# |   httpd/requests: 1523
# |_  httpd/bulk_requests: 42
```

## Database Listing

The `/_all_dbs` endpoint returns every database on the server.

```bash
curl -s http://$TARGET_IP:5984/_all_dbs | python3 -m json.tool
# [
#   "_global_changes",
#   "_replicator",
#   "_users",
#   "customers",
#   "internal_docs",
#   "secrets"
# ]
```

## Document Listing

For each database, list all document IDs with `/_all_docs`. Add `?include_docs=true` to retrieve full document contents.

**List document IDs in a database**

```bash
curl -s http://$TARGET_IP:5984/secrets/_all_docs | python3 -m json.tool
# {
#   "total_rows": 3,
#   "offset": 0,
#   "rows": [
#     {"id": "api-key-prod", "key": "api-key-prod", "value": {"rev": "1-abc"}},
#     {"id": "db-creds", "key": "db-creds", "value": {"rev": "1-def"}},
#     {"id": "ssh-key", "key": "ssh-key", "value": {"rev": "1-ghi"}}
#   ]
# }
```

**Retrieve a specific document**

```bash
curl -s http://$TARGET_IP:5984/secrets/db-creds | python3 -m json.tool
```

## User Enumeration

The `_users` database stores CouchDB user accounts. If readable, it reveals usernames and password hashes.

```bash
curl -s http://$TARGET_IP:5984/_users/_all_docs?include_docs=true | python3 -m json.tool
```

## Configuration Endpoints

The `/_node/_local/_config` endpoint exposes server configuration including admin credentials in plaintext on older versions.

```bash
curl -s http://$TARGET_IP:5984/_node/_local/_config | python3 -m json.tool
```

If unauthenticated access is confirmed, continue to [CouchDB exploitation](https://hackindex.io/services/couchdb/exploitation/couchdb-unauthenticated-admin-access) for admin creation and remote code execution.

## References

- [CouchDB: API Reference](https://docs.couchdb.org/en/stable/api/index.html) - Official REST API documentation for all endpoints.
- [Nmap: couchdb-databases NSE Script](https://nmap.org/nsedoc/scripts/couchdb-databases.html) - Lists all databases on a CouchDB server.