Skip to content
HackIndex logo

HackIndex

MongoDB Service Discovery and Access Validation

2 min read Mar 28, 2026

Service discovery confirms that a port running MongoDB is actually MongoDB, retrieves the version, and establishes whether authentication is enforced. A version without authentication is an immediate finding — move to unauthenticated access to confirm the scope of exposure. Default port is 27017, but 27018 and 27019 are used in replica sets and sharded clusters.

nmap Service Detection

Run nmap with version detection and the MongoDB-specific NSE scripts to get version, build info, and database list without touching the shell:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 27017 --script mongodb-info $TARGET_IP 
27017/tcp open  mongodb  MongoDB 4.4.18
| mongodb-info:
|   MongoDB Build info
|     version = 4.4.18
|     javascriptEngine = mozjs
|   Server status
|     connections
|       current = 2
|       available = 838858
|     uptime = 3742
|_    ok = 1
┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 27017 --script mongodb-databases $TARGET_IP 
| mongodb-databases:
|   databases
|     0  name = admin  sizeOnDisk = 102400  empty = false
|     1  name = appdb  sizeOnDisk = 81920   empty = false
|     2  name = local  sizeOnDisk = 40960   empty = false
|_  totalSize = 225280

The mongodb-databases script returning database names without authentication is a confirmed unauthenticated exposure. Note the version from mongodb-info and cross-reference it against the MongoBleed affected version table immediately.

Run Both Scripts Together

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 27017 --script mongodb-info,mongodb-databases $TARGET_IP

Validate Access with mongosh

Connect interactively to confirm whether authentication is enforced. A successful connection without credentials confirms unauthenticated access:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 
Current Mongosh Log ID: abc123
Connecting to: mongodb://10.10.10.50:27017/
Using MongoDB: 4.4.18
Using Mongosh: 2.1.0

test>

A prompt without an authentication challenge confirms unauthenticated access. Run a quick check to confirm what identity the connection has:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.runCommand({connectionStatus: 1}))' 
{
  authInfo: {
    authenticatedUsers: [],
    authenticatedUserRoles: []
  },
  ok: 1
}

Empty authenticatedUsers and authenticatedUserRoles confirms the connection is unauthenticated. Move to server configuration enumeration to understand why auth is absent, and to unauthenticated access testing to establish the full scope.

Non-Interactive Version Check

Quick one-liner for scripted checks across multiple hosts:

┌──(kali㉿kali)-[~]
└─$ mongosh --host $TARGET_IP --port 27017 --quiet --eval 'db.version()' 2>/dev/null 
4.4.18
┌──(kali㉿kali)-[~]
└─$ for ip in $(cat targets.txt); do echo -n "$ip: "; mongosh --host $ip --port 27017 --quiet --eval 'db.version()' 2>/dev/null || echo 'no access'; done 
10.10.10.50: 4.4.18
10.10.10.51: no access
10.10.10.52: 6.0.5

References