Hadoop HDFS

Hadoop HDFS (Hadoop Distributed File System) is the primary storage system for Apache Hadoop clusters, designed to store large datasets across distributed nodes. The NameNode web UI runs on TCP port 9870 (port 50070 on older versions) and the RPC interface on TCP port 8020. DataNode web UIs typically run on port 9864. Nmap identifies these as http on the respective web ports.

Hadoop clusters are high-value targets containing large volumes of organizational data. Many deployments rely on network-level security rather than authentication, meaning anyone who can reach the cluster has full access. The NameNode web UI exposes the filesystem browser, cluster topology, and storage statistics. HDFS, YARN ResourceManager (port 8088), and MapReduce JobHistory interfaces frequently allow unauthenticated access, enabling data theft and arbitrary code execution through submitted jobs.

Enumeration starts with the NameNode web UI for filesystem browsing and cluster health. The HDFS CLI (hdfs dfs -ls /) lists stored data when no authentication is required. Checking the YARN ResourceManager for the ability to submit applications allows arbitrary code execution on the cluster. Reviewing HDFS permissions, checking for sensitive data in stored files, and testing the various Hadoop service UIs for unauthenticated access cover the standard assessment scope.