# MongoDB

> MongoDB NoSQL database pentesting covering auth misconfigs, operator injection, unauth data access, CVE exploitation, credential looting, and exfiltration of stored collections and sensitive documents

- **URL:** https://hackindex.io/services/mongodb
- **Type:** Service
- **Default ports:** 27017
- **Tags:** nosql, mongodb, database, document-store, linux
- **Published:** 2025-12-28
- **Updated:** 2026-07-14

MongoDB is a NoSQL document database that stores data in JSON-like BSON documents. It listens on **TCP 27017** by default for client connections. Nmap identifies the service as `mongodb`. Additional ports include 27018 for shard servers and 27019 for config servers in sharded deployments.

MongoDB has been one of the most commonly exposed databases on the internet. Older versions shipped without authentication enabled by default, and many instances still run this way. Unauthenticated access grants full read and write control over all databases, collections, and documents. Attackers routinely scan for open MongoDB instances to steal data or deploy ransomware by dropping collections and leaving ransom notes.

Enumeration starts with connecting via the `mongo` shell or `mongosh` to check for unauthenticated access. Listing databases (`show dbs`) and collections reveals the scope of stored data. Server status commands expose version info, replication topology, and configuration details. When authentication is enabled, weak credentials and overly permissive roles remain common attack vectors.

## Phases

- [Enumeration](https://hackindex.io/services/mongodb/enumeration.md): Covers discovery, config review, and user and role mapping for MongoDB (3 guides)
- [Vulnerability Discovery](https://hackindex.io/services/mongodb/vulnerability-discovery.md): Guides for finding auth gaps and misconfigs in MongoDB (2 guides)
- [Exploitation](https://hackindex.io/services/mongodb/exploitation.md): Heap leak CVE, unauth data extraction, and operator injection guides (3 guides)
- [Post-Exploitation](https://hackindex.io/services/mongodb/post-exploitation.md): Covers looting credentials and pivoting via MongoDB data (1 guides)