Skip to content
HackIndex.io

Hadoop Enumeration

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

Apache Hadoop exposes multiple web interfaces and RPC ports across its components. The main services are HDFS NameNode (port 9870/50070), YARN ResourceManager (port 8088), and MapReduce JobHistory (port 19888). These web UIs often lack authentication, exposing cluster configuration, file system contents, and the ability to submit applications for code execution.

Port Discovery

Hadoop uses many ports. Scan the common range to identify which components are running.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 8020,8042,8088,9000,9870,19888,50070,50075 $TARGET_IP 
PORT      STATE SERVICE       VERSION
8020/tcp  open  hadoop-hdfs   Hadoop HDFS namenode
8042/tcp  open  http          Hadoop YARN NodeManager
8088/tcp  open  http          Hadoop YARN ResourceManager
9870/tcp  open  http          Hadoop HDFS NameNode WebUI
50075/tcp open  http          Hadoop HDFS DataNode WebUI

Key ports: 9870/50070 (HDFS NameNode UI), 8088 (YARN ResourceManager UI, leads to RCE), 8042 (NodeManager), 8020/9000 (HDFS RPC).

HDFS NameNode Web UI

The NameNode web UI (port 9870, or 50070 on older versions) provides a file browser for the entire HDFS filesystem.

┌──(kali㉿kali)-[~]
└─$ curl -s 'http://$TARGET_IP:9870/webhdfs/v1/?op=LISTSTATUS' | python3 -m json.tool 
{
  "FileStatuses": {
    "FileStatus": [
      {"pathSuffix": "tmp", "type": "DIRECTORY", "owner": "hdfs"},
      {"pathSuffix": "user", "type": "DIRECTORY", "owner": "hdfs"},
      {"pathSuffix": "data", "type": "DIRECTORY", "owner": "hadoop"}
    ]
  }
}

The WebHDFS REST API allows listing, reading, and writing files. No authentication by default.

┌──(kali㉿kali)-[~]
└─$ curl -s -L 'http://$TARGET_IP:9870/webhdfs/v1/user/hadoop/config.xml?op=OPEN'
Explain command
-L Follow the redirect to the DataNode that holds the file data.

OPEN returns a 307 redirect to the DataNode serving the file. The -L flag follows it automatically. Look for credentials, configs, and application data.

YARN ResourceManager

The YARN ResourceManager UI (port 8088) shows running and completed applications. More critically, it accepts new application submissions.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8088/ws/v1/cluster/apps | python3 -m json.tool

Application list reveals running jobs, users, queues, and resource allocation. Check for application logs that may contain credentials.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8088/ws/v1/cluster/nodes | python3 -m json.tool

Returns all cluster nodes with internal IPs, ports, resource capacity, and health status.

Configuration Exposure

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8088/conf | python3 -m json.tool

Dumps the full Hadoop configuration as XML/JSON. Check for: fs.defaultFS (HDFS address), yarn.resourcemanager.address, authentication settings, and any property containing password/secret/key.

If YARN ResourceManager is accessible on port 8088, continue to Hadoop YARN RCE for unauthenticated command execution via application submission.

References