08TCP
Elasticsearch
- Tools
- https://github.com/misalabs/horuz
msf > use auxiliary/scanner/elasticsearch/indices_enum- Nmap NSE script
- Basic Enumeration
bash54 lines
# If status code is 403, there is no any authenticationcurl -X GET http://10.10.10.115:9200/_xpack/security/user
# Get basic infocurl -X GET http://10.10.10.115:9200/ | jq .
# List all rolescurl -X GET http://10.10.10.115:9200/_security/role/
# List all userscurl -X POST http://10.10.10.115:9200/_security/user
# List info for user ABCcurl -X POST http://10.10.10.115:9200/_security/user/ABC
# List endpoints infocurl -X GET http://10.10.10.115:9200/_cat
curl -X GET http://10.10.10.115:9200/_cluster/allocation/explain | jq .curl -X GET http://10.10.10.115:9200/_cluster/settings | jq .curl -X GET http://10.10.10.115:9200/_cluster/health | jq .curl -X GET http://10.10.10.115:9200/_cluster/state | jq .curl -X GET http://10.10.10.115:9200/_cluster/stats | jq .curl -X GET http://10.10.10.115:9200/_cluster/pending_tasks | jq .curl -X GET http://10.10.10.115:9200/_nodes | jq .curl -X GET http://10.10.10.115:9200/_nodes/usage | jq .curl -X GET http://10.10.10.115:9200/_nodes/stats | jq .curl -X GET http://10.10.10.115:9200/_tasks | jq .curl -X GET http://10.10.10.115:9200/_remote/info | jq .
curl -X GET http://10.10.10.115:9200/_security/user | jq .curl -X GET http://10.10.10.115:9200/_security/privilege | jq .curl -X GET http://10.10.10.115:9200/_security/role_mapping | jq .curl -X GET http://10.10.10.115:9200/_security/role | jq .curl -X GET http://10.10.10.115:9200/_security/api_key | jq .
# List all the indicescurl -X GET http://10.10.10.115:9200/_cat/indices?v
# Dump saved data inside an indexcurl -X GET http://10.10.10.115:9200/<index>curl -X GET http://10.10.10.115:9200/bank | jq .# Dump all infomationcurl -X GET http://10.10.10.115:9200/<index>/_search?pretty=true
# Write new indexcurl -X POST '10.10.10.115:9200/h4rithd/books' -H 'Content-Type: application/json' -d' { "bookId" : "90A-3", "author" : "h4rithd", "publisher" : "h4rithd", "name" : "h4rithd was there!" }'- Default creds
bash8 lines
elastic (superuser) : changemeremote_monitoring_userbeats_systemlogstash_systemkibanakibana_systemapm_system_anonymous