MongoDB

MongoDB is a NoSQL document database that stores data in JSON-like BSON documents. It listens on TCP 27017 by default for client connections. Nmap identifies the service as mongodb. Additional ports include 27018 for shard servers and 27019 for config servers in sharded deployments.

MongoDB has been one of the most commonly exposed databases on the internet. Older versions shipped without authentication enabled by default, and many instances still run this way. Unauthenticated access grants full read and write control over all databases, collections, and documents. Attackers routinely scan for open MongoDB instances to steal data or deploy ransomware by dropping collections and leaving ransom notes.

Enumeration starts with connecting via the mongo shell or mongosh to check for unauthenticated access. Listing databases (show dbs) and collections reveals the scope of stored data. Server status commands expose version info, replication topology, and configuration details. When authentication is enabled, weak credentials and overly permissive roles remain common attack vectors.