Grafana

Grafana is an open-source analytics and monitoring platform used for visualizing metrics from data sources like Prometheus, Elasticsearch, InfluxDB, and databases. It typically runs on TCP port 3000. Nmap identifies it as http on this port, with Grafana identifiable through response headers and the login page.

Grafana instances are attractive targets because they aggregate data from multiple backend systems and store data source credentials. Default credentials (admin:admin) are a frequent finding. Known path traversal vulnerabilities (such as CVE-2021-43798) have allowed unauthenticated arbitrary file reads on the server. Grafana's data source proxy feature can be leveraged to access backend databases and APIs that are otherwise not directly reachable, turning Grafana into an SSRF pivot point.

Enumeration begins with checking for the default login, then testing known credentials and attempting user registration if self-signup is enabled. The /api/datasources endpoint (when authenticated) reveals all configured data sources with connection details. Exploring dashboard configurations can expose sensitive queries, internal hostnames, and infrastructure topology. Checking the Grafana version against known CVEs and testing the data source proxy for SSRF opportunities are standard assessment steps.