# Hadoop Enumeration

> Techniques for enumerating Hadoop HDFS clusters, identifying misconfigurations, exposed APIs, and gathering intelligence on distributed file system infrastructure.

- **URL:** https://hackindex.io/services/hadoop-hdfs/enumeration/hadoop-enumeration
- **Path:** Hadoop HDFS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/hadoop-hdfs/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Apache Hadoop exposes multiple web interfaces and RPC ports across its components. The main services are HDFS NameNode (port 9870/50070), YARN ResourceManager (port 8088), and MapReduce JobHistory (port 19888). These web UIs often lack authentication, exposing cluster configuration, file system contents, and the ability to submit applications for code execution.

## Port Discovery

Hadoop uses many ports. Scan the common range to identify which components are running.

```bash
nmap -sV -p 8020,8042,8088,9000,9870,19888,50070,50075 $TARGET_IP
# PORT      STATE SERVICE       VERSION
# 8020/tcp  open  hadoop-hdfs   Hadoop HDFS namenode
# 8042/tcp  open  http          Hadoop YARN NodeManager
# 8088/tcp  open  http          Hadoop YARN ResourceManager
# 9870/tcp  open  http          Hadoop HDFS NameNode WebUI
# 50075/tcp open  http          Hadoop HDFS DataNode WebUI
```

## HDFS NameNode Web UI

The NameNode web UI (port 9870, or 50070 on older versions) provides a file browser for the entire HDFS filesystem.

**Browse HDFS root directory**

```bash
curl -s 'http://$TARGET_IP:9870/webhdfs/v1/?op=LISTSTATUS' | python3 -m json.tool
# {
#   "FileStatuses": {
#     "FileStatus": [
#       {"pathSuffix": "tmp", "type": "DIRECTORY", "owner": "hdfs"},
#       {"pathSuffix": "user", "type": "DIRECTORY", "owner": "hdfs"},
#       {"pathSuffix": "data", "type": "DIRECTORY", "owner": "hadoop"}
#     ]
#   }
# }
```

**Read a file from HDFS**

```bash
curl -s -L 'http://$TARGET_IP:9870/webhdfs/v1/user/hadoop/config.xml?op=OPEN'
```

## YARN ResourceManager

The YARN ResourceManager UI (port 8088) shows running and completed applications. More critically, it accepts new application submissions.

**List running applications**

```bash
curl -s http://$TARGET_IP:8088/ws/v1/cluster/apps | python3 -m json.tool
```

**Cluster info and node list**

```bash
curl -s http://$TARGET_IP:8088/ws/v1/cluster/nodes | python3 -m json.tool
```

## Configuration Exposure

```bash
curl -s http://$TARGET_IP:8088/conf | python3 -m json.tool
```

If YARN ResourceManager is accessible on port 8088, continue to [Hadoop YARN RCE](https://hackindex.io/services/hadoop/exploitation/hadoop-yarn-rce) for unauthenticated command execution via application submission.

## References

- [Hadoop: WebHDFS REST API](https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-hdfs/WebHDFS.html) - Official HDFS REST API for file operations.
- [HackTricks: Pentesting Hadoop](https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/hadoop.html) - Hadoop enumeration and exploitation reference.