# Grafana Enumeration

> Enumerate Grafana instances by identifying version, default credentials, API endpoints, and exposed dashboards to assess misconfigurations and attack surface.

- **URL:** https://hackindex.io/services/grafana/enumeration/grafana-enumeration
- **Path:** Grafana > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/grafana/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Grafana is a monitoring and visualization platform that runs on port 3000 by default. Enumeration identifies the version, checks for default credentials, and maps accessible API endpoints. Many Grafana instances allow unauthenticated access to dashboards or use default credentials (`admin:admin`), making it a frequent low-hanging target in internal networks and CTFs.

## Version Detection

The login page and API both expose the Grafana version.

**Version from the health endpoint**

```bash
curl -s http://$TARGET_IP:3000/api/health | python3 -m json.tool
# {
#   "commit": "e531e4e",
#   "database": "ok",
#   "version": "8.2.6"
# }
```

**Version from the login page**

```bash
curl -s http://$TARGET_IP:3000/login | grep -oP 'Grafana v[0-9.]+'
# Grafana v8.2.6
```

## Default Credentials

Grafana ships with default credentials `admin:admin`. On first login it prompts for a password change, but many instances skip this.

```bash
curl -s -o /dev/null -w '%{http_code}' http://admin:admin@$TARGET_IP:3000/api/org
# 200
```

## Anonymous Access

Grafana can be configured to allow anonymous (unauthenticated) access to dashboards. Check whether the API responds without credentials.

```bash
curl -s http://$TARGET_IP:3000/api/dashboards/home | python3 -m json.tool
```

## Dashboard and Datasource Enumeration

With valid credentials (or anonymous access), list all dashboards and configured data sources.

**List all dashboards**

```bash
curl -s -u admin:admin http://$TARGET_IP:3000/api/search?query= | python3 -m json.tool
# [
#   {
#     "id": 1,
#     "uid": "abc123",
#     "title": "Infrastructure Overview",
#     "uri": "db/infrastructure-overview",
#     "type": "dash-db"
#   },
#   {
#     "id": 2,
#     "uid": "def456",
#     "title": "Database Monitoring",
#     "uri": "db/database-monitoring",
#     "type": "dash-db"
#   }
# ]
```

**List configured data sources**

```bash
curl -s -u admin:admin http://$TARGET_IP:3000/api/datasources | python3 -m json.tool
# [
#   {
#     "id": 1,
#     "name": "Prometheus",
#     "type": "prometheus",
#     "url": "http://10.10.10.50:9090",
#     "access": "proxy",
#     "isDefault": true
#   },
#   {
#     "id": 2,
#     "name": "MySQL",
#     "type": "mysql",
#     "url": "10.10.10.51:3306",
#     "access": "proxy",
#     "database": "webapp",
#     "user": "grafana_reader"
#   }
# ]
```

## User and Organization Enumeration

**List users (requires admin)**

```bash
curl -s -u admin:admin http://$TARGET_IP:3000/api/users | python3 -m json.tool
```

## API Key Enumeration

Admin users can list and create API keys. Existing API keys may have broader access than the compromised account.

```bash
curl -s -u admin:admin http://$TARGET_IP:3000/api/auth/keys | python3 -m json.tool
```

If the version is below 8.3.0, check [CVE-2021-43798 directory traversal](https://hackindex.io/services/grafana/exploitation/grafana-directory-traversal-cve-2021-43798) for unauthenticated file read.

## References

- [Grafana: HTTP API Reference](https://grafana.com/docs/grafana/latest/developers/http_api/) - Official API documentation for all endpoints.
- [HackTricks: Pentesting Grafana](https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/grafana.html) - Grafana enumeration and exploitation reference.