I was watching this video https://www.youtube.com/watch?v=Qm7k1CPFkIc about how to steal passwords and the guy mentioned that you can use shodan.io (a site that lists various devices connected to the internet) to find a database you can easily scrape for passwords.

Simply searching "mongo" gives you a list of exposed MongoDB databases as shown here https://www.shodan.io/search?query=mongo

Do web-hosting services like Heroku and Railway have protections in place to ensure that your database can't be discoverable on sites like shodan.io?

1 Answer 1


The term “exposed” is a bit misleading in this context.

It's perfectly legitimate to have a database system which is reachable from the Internet. The only other options are to put the database system and the services which use the system (e. g. web applications) onto the same machine or into a private network. Depending on the infrastructure of the hosting service, this may not be possible or desirable.

When a database system is running on a public IP address, that doesn't mean anybody can just connect to it and access any data they want. A properly configured database system requires authentication, be it through a password or a stronger method like client certificates. Without the credentials, connection attempts will be immediately rejected. But even if you have the credentials for some account, you will only be able to access the data of that account, because common database systems also check whether a particular user is authorized to read, change or add specific data.

I don't know the specifics for Heroku or Railway, but given that these are professional services, I'd be very surprised if they kept their customers' data on a publicly accessible database server without any authentication and authorization.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .