> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/misc/databases/mongodb.md).

# MongoDB

MongoDB is a source-available, cross-platform, document-oriented database program. Classified as a NoSQL database product, MongoDB utilizes JSON-like documents with optional schemas.

## Nmap MongoDB Scripts

There are a few MongoDB scripts in nmap

<table><thead><tr><th width="205">Script</th><th>Description</th></tr></thead><tbody><tr><td><a href="https://nmap.org/nsedoc/scripts/mongodb-brute.html">mongodb-brute</a></td><td>Performs brute force password auditing against the MongoDB database.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/mongodb-databases.html">mongodb-databases</a></td><td>Attempts to get a list of tables from a MongoDB database.</td></tr><tr><td><a href="https://nmap.org/nsedoc/scripts/mongodb-info.html">mongodb-info</a></td><td>Attempts to get build info and server status from a MongoDB database.</td></tr></tbody></table>

## Mongo tool

### Installation

```bash
sudo apt install mongodb-clients
```

### Connect to a database

```bash
mongo mongodb://$TARGET_IP:27017
```

Check what databases are present

```
show dbs;
```

Select a database and list its collections

```
use <database>;
show collections;
```

Get all the documents in the flag collection

```
> db.flag.find();
{ "_id" : ObjectId("630e3dbcb82540ebbd1748c5"), "flag" : "1<REDACTED>a" }
> 
```

Or like this if we want a prettier output

```
> db.flag.find().pretty();
{
        "_id" : ObjectId("630e3dbcb82540ebbd1748c5"),
        "flag" : "1<REDACTED>a"
}
```

## Usage information

<details>

<summary>mongo -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ mongo -h
MongoDB shell version v6.1.1
usage: mongo [options] [db address] [file names (ending in .js)]
db address can be:
  foo                   foo database on local machine
  192.168.0.5/foo       foo database on 192.168.0.5 machine
  192.168.0.5:9999/foo  foo database on 192.168.0.5 machine on port 9999
  mongodb://192.168.0.5:9999/foo  connection string URI can also be used
Options:
  --ipv6                               enable IPv6 support (disabled by 
                                       default)
  --host arg                           server to connect to
  --port arg                           port to connect to
  -h [ --help ]                        show this usage information
  --version                            show version information
  --verbose                            increase verbosity
  --shell                              run the shell after executing files
  --nodb                               don't connect to mongod on startup - no 
                                       'db address' arg expected
  --norc                               will not run the ".mongorc.js" file on 
                                       start up
  --quiet                              be less chatty
  --eval arg                           evaluate javascript
  --apiVersion arg                     set the MongoDB API version
  --apiStrict                          disable all features not included in the
                                       MongoDB Stable API
  --apiDeprecationErrors               disable all features deprecated in the 
                                       MongoDB Stable API
  --disableJavaScriptJIT               disable the Javascript Just In Time 
                                       compiler
  --enableJavaScriptJIT                enable the Javascript Just In Time 
                                       compiler
  --disableJavaScriptProtection        allow automatic JavaScript function 
                                       marshalling
  --retryWrites                        automatically retry write operations 
                                       upon transient network errors
  --disableImplicitSessions            do not automatically create and use 
                                       implicit sessions
  --jsHeapLimitMB arg                  set the js scope's heap size limit
  --idleSessionTimeout arg (=0)        Terminate the Shell session if it's been
                                       idle for this many seconds

FLE AWS Options:
  --awsAccessKeyId arg                 AWS Access Key for FLE Amazon KMS
  --awsSecretAccessKey arg             AWS Secret Key for FLE Amazon KMS
  --awsSessionToken arg                Optional AWS Session Token ID
  --keyVaultNamespace arg              database.collection to store encrypted 
                                       FLE parameters
  --kmsURL arg                         Test parameter to override the URL for 
                                       KMS

Authentication Options:
  -u [ --username ] arg                username for authentication
  -p [ --password ] arg                password for authentication
  --authenticationDatabase arg         user source (defaults to dbname)
  --authenticationMechanism arg        authentication mechanism
  --gssapiServiceName arg (=mongodb)   Service name to use when authenticating 
                                       using GSSAPI/Kerberos
  --gssapiHostName arg                 Remote host name to use for purpose of 
                                       GSSAPI/Kerberos authentication

TLS Options:
  --tls                                use TLS for all connections
  --tlsCertificateKeyFile arg          PEM certificate/key file for TLS
  --tlsCertificateKeyFilePassword arg  Password for key in PEM file for TLS
  --tlsCAFile arg                      Certificate Authority file for TLS
  --tlsCRLFile arg                     Certificate Revocation List file for TLS
  --tlsAllowInvalidHostnames           Allow connections to servers with 
                                       non-matching hostnames
  --tlsAllowInvalidCertificates        Allow connections to servers with 
                                       invalid certificates
  --tlsDisabledProtocols arg           Comma separated list of TLS protocols to
                                       disable [TLS1_0,TLS1_1,TLS1_2,TLS1_3]

AWS IAM Options:
  --awsIamSessionToken arg             AWS Session Token for temporary 
                                       credentials

file names: a list of files to run. files have to end in .js and will exit after unless --shell is specified
                                                                                                              
```

</details>

## Resources

Pentesting MongoDB - HackTricks: <https://hacktricks.wiki/en/network-services-pentesting/27017-27018-mongodb.html>

MongoDB - Wikipedia: <https://en.wikipedia.org/wiki/MongoDB>