/exposed-databases

name: exposed-databases
description: |
  This skill should be used when the user mentions "Shodan", "Censys", "MongoDB exposed", "Elasticsearch open", "Redis no auth", "open database", "unauthenticated database", "exposed MongoDB", "exposed Elasticsearch", "exposed Redis", "exposed CouchDB", "exposed MySQL", "exposed PostgreSQL", "port 27017", "port 9200", "port 6379", "port 5984", "port 3306", "port 5432", "find open databases", "database hunting", "scan for databases", "internet-facing database", "no authentication database", "database fingerprinting", "Kibana exposed", "Mongo Express", "phpMyAdmin exposed", or discusses finding internet-facing databases with no authentication, scanning for specific database ports, fingerprinting exposed data services, or triaging Shodan/Censys results to identify high-value targets. Always use this skill when the task involves discovering or probing exposed databases, even if the user doesn't use these exact phrases — for instance, "check if their MongoDB is open" or "look for exposed services on that IP range" should trigger this skill.

Exposed Database Hunting

Discover internet-facing databases with no authentication, triage them by value, probe safely to confirm access, and route confirmed targets into the acquisition pipeline.

Workflow

The exposed database hunting process follows five phases. Complete each phase before moving to the next — skipping triage leads to wasted probes on low-value or out-of-scope targets.

SCOPE → DISCOVER → TRIAGE → PROBE → ROUTE
  │         │          │        │        │
  │         │          │        │        ├─ open → data-acquisition skill
  │         │          │        │        └─ protected → cross-plugin-pipeline (elliot handoff)
  │         │          │        └─ dumper.js probe + source-tracker.js add
  │         │          └─ prioritize by data value, size, auth certainty
  │         └─ hunt-engine.js (shodan, dork, github) + Censys
  └─ verify target is in-scope for the active engagement

---

Phase 1: Scope Check

Before generating any queries, verify the target is authorized:

1. Check `engagement.json` or the active campaign's scope definition 2. Confirm the target domain, IP range, or organization is explicitly in-scope 3. If no engagement is active, ask the operator to confirm authorization before proceeding

Never probe hosts outside the authorized scope, regardless of what Shodan/Censys returns.

---

Phase 2: Discovery

Generate queries across multiple sources to maximize coverage. The hunt engine produces structured queries — it does not execute them. You execute them via MCP tools (Hexstrike Shodan, Brave Search) or direct API calls.

Shodan Queries

node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js shodan <target> [--service mongo|elastic|redis|couch|mysql|postgres|all]

The engine generates queries filtered by service type and scoped to the target (by hostname for domains, by CIDR for IP ranges). Covers MongoDB (27017), Elasticsearch (9200), Redis (6379), CouchDB (5984), MySQL (3306), PostgreSQL (5432), and Kibana (5601).

Execute each generated query via MCP Shodan tool. For each result, extract:

• **IP and port** — the probe target
• **ASN and organization** — verify it belongs to the target's infrastructure
• **Banner data** — version string, auth status indicators, database/index names if visible

Censys Queries

Censys uses a SQL-like search syntax. Generate equivalent queries manually:

| Database | Censys Query | |----------|-------------| | MongoDB | `services.port=27017 AND services.service_name=MONGODB AND autonomous_system.name="Target Org"` | | Elasticsearch | `services.port=9200 AND services.http.response.body:"You Know, for Search" AND labels="Target"` | | Redis | `services.port=6379 AND services.banner:"redis_version" AND autonomous_system.name="Target Org"` | | CouchDB | `services.port=5984 AND services.http.response.body:"couchdb" AND autonomous_system.name="Target Org"` | | MySQL | `services.port=3306 AND services.service_name=MYSQL AND autonomous_system.name="Target Org"` | | PostgreSQL | `services.port=5432 AND services.service_name=POSTGRESQL AND autonomous_system.name="Target Org"` |

Replace `"Target Org"` with the actual ASN organization name or use `ip:` for CIDR ranges.

Google Dorks

node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js dork <target> --category exposed-db

Generates dorks for phpMyAdmin panels, exposed Elasticsearch `_cat/indices` endpoints, MongoDB HTTP interfaces, CouchDB Futon/Fauxton UIs, and Adminer. These catch web-facing admin UIs that Shodan might miss.

GitHub Leak Search

node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js github <target> --type secrets

Finds connection strings (`mongodb+srv://`, `redis://`, JDBC URLs) leaked in public repos. A leaked connection string with credentials is a direct path to a database that may not appear on Shodan at all.

---

Phase 3: Triage

Discovery will produce a list of candidate hosts. Probe them in priority order — not randomly. Each result has signals in the Shodan/Censys banner that help you decide what to probe first.

Priority Matrix

| Priority | Signal | Why | |----------|--------|-----| | **P1 — Probe immediately** | Banner shows database names containing `users`, `customers`, `accounts`, `credentials`, `emails`, or PII-related terms. Auth is confirmed disabled (MongoDB `ok: 1`, Elasticsearch `200`, Redis version info without `NOAUTH`). | High-value data, confirmed open — maximum ROI. | | **P2 — Probe soon** | Port is open and service is identified, but banner doesn't reveal auth status or data content. Large estimated size. | Needs verification but likely worth it. | | **P3 — Probe if time allows** | Service detected but port is non-standard, or banner suggests auth is enabled (401, `NOAUTH`, `code: 13`). | Low probability of open access. | | **Skip** | IP/ASN doesn't belong to target. Out-of-scope geography. Banner confirm