Lucene search
+L

Enumerate MongoDB Collections

🗓️ 10 Jul 2026 11:31:42Reported by KittySploitType 
kittysploit
 kittysploit
🔗 kittysploit.com👁 1 Views

KittySploit module to enumerate MongoDB databases, collections, and document samples.

Refs
Code
from kittysploit import *
from lib.protocols.mongodb.mongodb_client import MongoDBClient


class Module(Post, MongoDBClient):

	__info__ = {
		"name": "Enumerate MongoDB Collections",
		"description": "Enumerate MongoDB databases, collections, and optional document samples",
		"author": "KittySploit Team",
		"session_type": SessionType.MONGODB,
	'agent': {
	    'risk': 'intrusive',
	    'effects': ['active_exploitation'],
	    'expected_requests': 2,
	    'reversible': False,
	    'approval_required': True,
	    'produces': ['risk_signals'],
	    'cost': 1.5,
	    'noise': 0.5,
	    'value': 1.0,
	    'requires': 	    {'min_endpoints': 0,
	     'min_params': 0,
	     'tech_hints_any': [],
	     'tech_hints_all': [],
	     'specializations_any': [],
	     'risk_signals_any': [],
	     'auth_session': False,
	     'capabilities_any': [],
	     'capabilities_all': [],
	     'confidence_min': {},
	     'confidence_min_any': {},
	     'endpoint_pattern_any': [],
	     'param_any': [],
	     'api_surface_ready': False},
	    'chain': 	    {'produces_capabilities': [{'capability': 'db_access', 'from_detail': ''}],
	     'consumes_capabilities': [],
	     'option_bindings': {},
	     'suggested_followups': []},
	},
	}

	database = OptString("", "Limit to one database (empty = all)", False)
	collection_filter = OptString("", "Filter collections by substring", False)
	show_stats = OptBool(True, "Show collection document counts", False)
	show_data = OptBool(False, "Show sample documents (limit 5 per collection)", False)
	skip_empty = OptBool(True, "Skip collections with zero documents when stats are available", False)

	def run(self):
		try:
			info = self.get_session_info()
			print_info("=" * 80)
			print_status("MongoDB session")
			for key in ("host", "port", "database", "version"):
				if info.get(key):
					print_info(f"  {key}: {info[key]}")

			databases = self.list_databases()
			if self.database:
				databases = [db for db in databases if db == str(self.database).strip()]

			name_filter = str(self.collection_filter or "").strip().lower()
			print_info("-" * 80)
			print_status(f"Databases ({len(databases)})")

			for db_name in databases:
				print_info(f"\n  Database: {db_name}")
				collections = self.list_collections(db_name)
				if name_filter:
					collections = [c for c in collections if name_filter in c.lower()]
				if not collections:
					print_info("    (no collections)")
					continue

				for coll_name in collections:
					stats = {}
					if self.show_stats or self.skip_empty:
						try:
							stats = self.collection_stats(db_name, coll_name)
						except ProcedureError:
							stats = {}
					count = stats.get("count")
					if self.skip_empty and count == 0:
						continue

					line = f"    - {coll_name}"
					if count is not None:
						line += f" ({count} document(s))"
					print_info(line)
					if stats.get("size") is not None:
						print_info(
							f"        size={stats.get('size')} bytes, "
							f"storageSize={stats.get('storageSize', 'n/a')}"
						)

					if self.show_data:
						try:
							docs = self.sample_documents(db_name, coll_name, limit=5)
							if docs:
								for i, doc in enumerate(docs, 1):
									print_info(f"        [{i}] {doc}")
							else:
								print_info("        (empty collection)")
						except Exception as exc:
							print_warning(f"        Could not sample documents: {exc}")

			print_info("=" * 80)
			print_success("MongoDB collection enumeration completed")
			return True
		except ProcedureError:
			raise
		except Exception as exc:
			raise ProcedureError(
				FailureType.Unknown, f"Error enumerating MongoDB collections: {exc}"
			)

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

02 Aug 2026 20:51Current
5.8Medium risk
Vulners AI Score5.8
1