AWS - DocumentDB Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

DocumentDB

Amazon DocumentDB, inatoa ulinganifu na MongoDB, inawasilishwa kama huduma ya hifadhidata ya haraka, ya kuaminika, na inayosimamiwa kikamilifu. Imeundwa kwa urahisi katika kutekeleza, kufanya kazi, na kupanuka, inaruhusu uhamishaji na uendeshaji wa hifadhidata zinazolingana na MongoDB katika wingu. Watumiaji wanaweza kutumia huduma hii kutekeleza msimbo wao wa programu uliopo na kutumia madereva na zana zinazofahamika, kuhakikisha mpito na uendeshaji laini kama kufanya kazi na MongoDB.

Enumeration

aws docdb describe-db-clusters # Get username from "MasterUsername", get also the endpoint from "Endpoint"
aws docdb describe-db-instances #Get hostnames from here

# Parameter groups
aws docdb describe-db-cluster-parameter-groups
aws docdb describe-db-cluster-parameters --db-cluster-parameter-group-name <param_group_name>

# Snapshots
aws docdb describe-db-cluster-snapshots
aws --region us-east-1 --profile ad docdb describe-db-cluster-snapshot-attributes --db-cluster-snapshot-identifier <snap_id>

NoSQL Injection

Kwa kuwa DocumentDB ni hifadhidata inayofanana na MongoDB, unaweza kufikiria kwamba pia ina udhaifu kwa mashambulizi ya kawaida ya NoSQL injection:

NoSQL injectionHackTricks

DocumentDB

AWS - DocumentDB Unauthenticated Enum

References

• https://aws.amazon.com/blogs/database/analyze-amazon-documentdb-workloads-with-performance-insights/

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.