# Elasticsearch

> Search and analytics engine

- **URL:** https://hackindex.io/services/elasticsearch
- **Type:** Service
- **Default ports:** 9200, 9300
- **Tags:** web, api, linux, database, json, http
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

Elasticsearch is a distributed search and analytics engine built on Apache Lucene. It listens on **TCP 9200** for its REST API (HTTP) and **TCP 9300** for internal cluster transport communication. Nmap typically identifies port 9200 as `http` or `elasticsearch` depending on the scan scripts used.

Exposed Elasticsearch instances are a top source of data breaches. By default, older versions ship without authentication, meaning anyone who can reach port 9200 can read, modify, or delete every index. Even when X-Pack security is enabled, weak credentials and misconfigured roles are common. Sensitive data such as logs, user records, and application data often ends up in indices with no access restrictions.

Enumeration begins with requesting the root endpoint (`/`) for version and cluster info, then listing indices via `/_cat/indices`. The `/_search` API allows querying all data. Cluster health, node info, and snapshot repositories reveal infrastructure details. Known vulnerabilities include Groovy and Painless script injection for remote code execution on unpatched versions.

## Phases

- [Enumeration](https://hackindex.io/services/elasticsearch/enumeration.md): Covers REST API enum of auth, version, cluster, indices, mappings (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/elasticsearch/vulnerability-discovery.md): Guides for finding unauth access and exposed indices in Elasticsearch (1 guides)
- [Exploitation](https://hackindex.io/services/elasticsearch/exploitation.md): RCE via Groovy script injection and sandbox escape on 1.x/2.x (1 guides)
- [Data Exfiltration](https://hackindex.io/services/elasticsearch/data-exfiltration.md): Extract data from open Elasticsearch via scroll API and bulk export (1 guides)