Skip to content
attack.paths
Connexion
← RegistryDossier · 5 steps · 4 edges

Open MongoDB → dump every collection

Shodan-indexed MongoDB on 27017 with no auth. Connect, list databases, dump every collection. Often the second stage is a ransom note in a new 'README' collection.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target operator left MongoDB exposed to the internet without authentication (defaults pre-3.6 + persistent misconfig in self-hosted deployments).

§ Steps

  1. 01
    mongodump every databaseExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Drop README collection with ransom noteImpact
    T1486— Data Encrypted for Impact
  3. 03
    show dbs / show collectionsDiscovery
    T1087— Account Discovery
  4. 04
    Shodan: port:27017 mongodbReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  5. 05
    mongosh --host <ip> → connects unauthInitial Access
    DB-MONGO-NOAUTH— MongoDB / DocumentDB No-Auth Open

§ References

§ Frequently asked

What is the "Open MongoDB → dump every collection" attack path?
Shodan-indexed MongoDB on 27017 with no auth. Connect, list databases, dump every collection. Often the second stage is a ransom note in a new 'README' collection. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is mongodump every database (T1041) — a exfiltration primitive. Assumed environment: target operator left MongoDB exposed to the internet without authentication (defaults pre-3.
What is the final impact of this kill-chain?
The final step lands on mongosh --host <ip> → connects unauth (DB-MONGO-NOAUTH), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

Open MongoDB → dump every collection | Attack Paths