,-.
/ \ `. __..-,O 88888b.d88b. .d88b. 88888b. .d88b. .d88b.
: \ --''_..-'.' 888 "888 "88bd88""88b888 "88bd88P"88bd88""88b
| . .-' `. '. 888 888 888888 888888 888888 888888 888
: . .`.' 888 888 888Y88..88P888 888Y88b 888Y88..88P
\ `. / .. 888 888 888 "Y88P" 888 888 "Y88888 "Y88P"
\ `. ' . 888
`, `. \ 888 Y8b d88P
,|,`. `-.\ 888 "Y88P"
'.|| ``-...__..-` 888
| | 888d888 8888b. .d88888 8888b. 888d888
|__| 888P" "88bd88" 888 "88 b888P"
/||\ 888 .d888888888 888.d88888 8888
//||\\ 888 888 888Y88b 888888 88 8888
// || \\ 888 "Y888888 "Y88888"Y88888 8888
__//__||__\\__
'--------------'
Multithread python3 script that scans and dumps mongo databases with default access (no password), through Tor sock4 proxy using proxychains and writes it into a log file.
There are tons of mongo databases without any type of authentication out there in the wild; a lot of them get hacked, that's why we should be really careful when configuring the Database.
Just for research purposes I developed an automated tool to discover and dump all the collections
in the discovered mongodb list.
In order to stay anonymous we use Tor service running as a SOCK4 proxy,
and proxychains to capture all tcp requests made by mongo-radar
and proxy them to the Tor SOCK4 port.
./mongo-radar [-h] [--out INPUT_OUT] [--ips INPUT_IPS]
[--workers INPUT_W] [--dump] [--kidnap INPUT_ACCOUNT]
optional arguments:
-h, --help show this help message and exit
--out INPUT_OUT Define the ouput folder location.
--ips INPUT_IPS Define list of ips or range of ips to scan. Ex:
127.0.0.1,127.0.0.2-255
--workers INPUT_WORKERS
Define the number of worker threads (> 4) that will be
doing the jobs simultaneously.
--dump Dumps all the databases found and saves it into out
directory.
The author does not hold any responsibility for the bad use of this tool,
remember that attacking targets without prior consent is illegal and punished by law.
- Tor sock4 proxy running on port 9050
- proxychains installed (binary
proxychains4on path) - python 3
- pipenv
- make
- mongodump (provided in the package
mongo-tools)
Run the install goal
make install
First give execution privileges
chmod +x mongo-radar
Now just execute ./mongo-radar.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent