If Mongo databases appear on www.Shodan.io, is it definitive proof that they are publicly accessible?

Is there a way to prove without doubt there is a risk without actually connecting to the server? (This shodan blog https://blog.shodan.io/its-still-the-data-stupid/ has useful info but I don't really know MongoDB).

  • The only way to be positive the instance in question is actually reachable and open at this very moment is trying to make a connection.
    – Tobi Nary
    May 16, 2016 at 12:01

2 Answers 2


If it is publicly facing and unauthenticated it is as easy as using a MongoDB administrative client, plugging in the server details, and connecting. Depending on the client's response would prove it is definitive.

This is exactly what Shodan is doing. They spider the internet making connections with everything. And try to dump whatever information they can get into their database. During this process they have it attempt a connection to the server as a MongoDB client and if their client responds successful they collect data such as DBs, size, server info dump, etc.


Note that in the case of MongoDB, the lack of authorization at the shell is by design. It is possible to connect unauthenticated to any MongoDB shell. However you are limited to just seeing the version number of mongo and whether the node you are connected to is a primary or secondary. Unless you authenticate as a user account with privileges for a given database, you cannot make any queries or perform any operations. Access to a mongo shell is not sufficient evidence that the database is "misconfigured."

Of course, one can argue whether this is a design flaw of MongoDB, and can certainly argue that all Mongo instances should whitelist IP addresses that connect to them, regardless of the level of authentication necessary to perform operations on a given instance.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .