Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2025-02-16 14:08:26 +00:00
Code Issues Projects Releases Packages Wiki Activity

GitBook: [master] 2 pages modified

Browse source
This commit is contained in:
CPol 2020-07-17 23:59:16 +00:00 • committed by gitbook-bot
parent 18c50dbb4f
commit e4689ab223
No known key found for this signature in database
GPG key ID: 07D2180C7B12D0FF
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
brute-force.md
View file

@ -79,6 +79,13 @@ nmap --script cassandra-brute -p 9160 <IP>
```bash
msf> use auxiliary/scanner/couchdb/couchdb_login
hydra /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 5984 http-get /
```
### Elasticsearch
```text
hydra /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst localhost -s 9200 http-get /
```
### FTP

3
pentesting/9200-pentesting-elasticsearch.md
View file

@ -35,7 +35,8 @@ If you don't see that response accessing `/` see the following section.
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}
```
That will means that authentication is configured an you need valid credentials to obtain any info from elasticserach. Then, you can **try to bruteforce it** \(it uses HTTP basic auth, so anything that BF HTTP basic auth can be used\).
That will means that authentication is configured an **you need valid credentials** to obtain any info from elasticserach. Then, you can [**try to bruteforce it**](../brute-force.md#elasticsearch) ****\(it uses HTTP basic auth, so anything that BF HTTP basic auth can be used\).
Here you have a **list default usernames**: _**elastic** \(superuser\), remote\_monitoring\_user, beats\_system, logstash\_system, kibana, kibana\_system, apm\_system_
### Elastic Info