5601 - Pentesting Kibana
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Kibana is known for its ability to search and visualize data within Elasticsearch, typically running on port 5601. It serves as the interface for the Elastic Stack cluster's monitoring, management, and security functions.
The process of authentication in Kibana is inherently linked to the credentials used in Elasticsearch. If Elasticsearch has authentication disabled, Kibana can be accessed without any credentials. Conversely, if Elasticsearch is secured with credentials, the same credentials are required to access Kibana, maintaining identical user permissions across both platforms. Credentials might be found in the /etc/kibana/kibana.yml file. If these credentials do not pertain to the kibana_system user, they may offer broader access rights, as the kibana_system user's access is restricted to monitoring APIs and the .kibana index.
Once access to Kibana is secured, several actions are advisable:
Exploring data from Elasticsearch should be a priority.
The ability to manage users, including the editing, deletion, or creation of new users, roles, or API keys, is found under Stack Management -> Users/Roles/API Keys.
It's important to check the installed version of Kibana for known vulnerabilities, such as the RCE vulnerability identified in versions prior to 6.6.0 (More Info).
In instances where SSL/TLS is not enabled, the potential for leaking sensitive information should be thoroughly evaluated.s
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
