## https://sploitus.com/exploit?id=KITPLOIT:6230906110179095668
**mongoaudit** is a CLI tool for auditing MongoDB servers, detecting poor security settings and performing automated penetration testing.
## Installing with pip
This is the recommended installation method in case you have ` python ` and ` pip ` .
pip install mongoaudit
## Alternative installer
Use this if and only if ` python ` and ` pip ` are not available on your platform.
curl -s https://mongoaud.it/install | bash
_ works on Mac OS X, GNU/Linux and Bash for Windows 10 _
_If you are serious about security you should always use the PIP installer or, better yet, follow best security practices: clone this repository, check the source code and only then run it with` python mongoaudit ` . _
## Introduction
It is widely known that there are quite a few holes in MongoDB's default configuration settings. This fact, combined with abundant lazy system administrators and developers, has led to what the press has called the _MongoDB apocalypse_ .
**mongoaudit** not only detects misconfigurations, known vulnerabilities and bugs but also gives you advice on how to fix them, recommends best practices and teaches you how to DevOp like a pro!
This is how the actual app looks like:
_Yep, that's material design on a console line interface. (Powered by urwid ) _
## Supported tests
* MongoDB listens on a port different to default one
* Server only accepts connections from whitelisted hosts / networks
* MongoDB HTTP status interface is not accessible on port 28017
* MongoDB is not exposing its version number
* MongoDB version is newer than 2.4
* TLS/SSL encryption is enabled
* Authentication is enabled
* SCRAM-SHA-1 authentication method is enabled
* Server-side Javascript is forbidden
* Roles granted to the user only permit CRUD operations *
* The user has permissions over a single database *
* Security bug CVE-2015-7882
* Security bug CVE-2015-2705
* Security bug CVE-2014-8964
* Security bug CVE-2015-1609
* Security bug CVE-2014-3971
* Security bug CVE-2014-2917
* Security bug CVE-2013-4650
* Security bug CVE-2013-3969
* Security bug CVE-2012-6619
* Security bug CVE-2013-1892
* Security bug CVE-2013-2132
_Tests marked with an asterisk (` * ` ) require valid authentication credentials. _
## How can I best secure my MongoDB?
Once you run any of the test suites provided by **mongoaudit** , it will offer you to receive a fully detailed report via email. This personalized report links to a series of useful guides on how to fix every specific issue and how to harden your MongoDB deployments.
For your convenience, we have also published the **mongoaudit** guides in our Medium publication .
**Disclaimer**
"With great power comes great responsibility"
* Never use this tool on servers you don't own. Unauthorized access to strangers' computer systems is a crime in many countries.
* Please use this tool is at your own risk. We will accept no liability for any loss or damage which you may incur no matter how caused.
* Don't be evil! 
** Download mongoaudit **