5 ms·
Google only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it. I believe Shodan does this.
by bifrost 7y ago
Google only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it.
I believe Shodan does this.
- devy 7y agoIs the background image on the TechCrunch article an UI for monogodb? Or is it just a FB GraphQL query browser UI?
- MapleWalnut 7y agoIt's MongoDB Compass, a client for Mongo.
- userbinator 7y agoIt also indexes ftp, but that may unfortunately be coming to an end[1]. Ironically enough, Google's mission statement is still "to organize the world's information and make it universally accessible and useful", which if taken to its logical conclusion would mean such humorously delightful things as scanning for mongos and indexing their contents too... [1] https://news.ycombinator.com/item?id=20721609 https://news.ycombinator.com/item?id=20721609
- lioeters 7y ago> to organize the world's information ..including any private data they can gather on you, via search, maps, analytics, browser.. I wouldn't put it past Google to be already indexing exposed databases (or continue indexing ftp), just not making it publicly available.
- bifrost 7y agoIts almost like people need a tool to tell them not to leave stuff open like that... Between MongoDB, Jenkins and Elasticsearch, thats a whole ecosystem of pwnability that is probably just starting to be exploited.