DB-MONGO-NOAUTHInitial Access

MongoDB / DocumentDB No-Auth Open

Shodan-indexed MongoDB / DocumentDB on 27017 / 27018 with no auth — full read/write access to every collection.

§ Where this technique fits

DB-MONGO-NOAUTH is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Open MongoDB → dump every collection
Shodan-indexed MongoDB on 27017 with no auth. Connect, list databases, dump every collection. Often the second stage is a ransom note in a new 'README' collection.
step 2 / 5

§ What commonly comes next

01
Account Discovery
T1087 · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Open MongoDB → dump every collection

§ What commonly comes next