How to check mongo db public availability without authentication?

How to check mongo db public availability without authentication?

  May 10, 2023    Davinder

---

MongoDB is a popular NoSQL database used by many organizations around the world. It is known for its flexibility and scalability, making it a popular choice for modern applications. However, like any database, it is important to ensure that it is secured properly. One of the key aspects of securing a MongoDB database is to ensure that it is not publicly accessible without proper authentication.

In this article, we will discuss how to check if a MongoDB database is publicly available without authentication. There are several tools and techniques available that can help you determine the public accessibility of your MongoDB database.

Method 1: Using Nmap

Nmap is a popular network scanner that can be used to scan for open ports and services on a network. By default, MongoDB listens on port 27017. Therefore, you can use Nmap to scan for this port to determine if a MongoDB database is running on the network.

To scan for port 27017 using Nmap, you can use the following command:

```

nmap -p 27017 <mongodb_server_ip>

```

If the scan returns that port 27017 is open, it means that a MongoDB database is running on the server and is publicly accessible without authentication.

Method 2: Using the MongoDB Shell

The MongoDB shell is a command-line interface that can be used to interact with a MongoDB database. If you have access to the MongoDB shell, you can use it to check if the database is publicly accessible.

To connect to the MongoDB shell, use the following command:

```

mongo --host <mongodb_server_ip> --port 27017

```

If the connection is successful, you will see the MongoDB shell prompt. You can then use the following command to check if authentication is required to access the database:

```

db.runCommand({ connectionStatus: 1 })

```

If authentication is not required, you will see the following output:

```

"ok" : 1,

"user" : "",

"authInfo" : {

  "authenticatedUsers" : [ ]

},

"ismaster" : true,

"...

If authentication is required, you will see output similar to the following:

```

"ok" : 0,

"errmsg" : "not authorized on admin to execute command { connectionStatus: 1.0, $db: \"admin\" }",

"code" : 13,

"codeName" : "Unauthorized",

"...

```

Method 3: Using the MongoDB Compass

The MongoDB Compass is a graphical user interface that can be used to manage MongoDB databases. If you have access to the MongoDB Compass, you can use it to check if the database is publicly accessible.

To connect to the MongoDB Compass, launch the application and enter the connection details. If the connection is successful, you will see the databases that are available on the server.

If the database does not require authentication, you will be able to access it without entering any credentials. You will also be able to see all the collections and documents in the database.

Conclusion

Securing a MongoDB database is an essential aspect of any modern application. It is important to ensure that the database is not publicly accessible without proper authentication. By using the methods outlined in this article, you can determine if your MongoDB database is publicly accessible without authentication. If it is, you should take steps to secure it immediately to avoid any potential security breaches.