MongoDB Credentials
Description
General
- Documentation: https://docs.mongodb.com/manual/reference/connection-string/
- Summary: MongoDB is a document-oriented database. This detector aims at finding MongoDB credentials in the form of URI connection strings, variable assignments or used when calling its CLIs.
Revoke the secret
User's permissions can be managed by database administrators. Users with appropriate privileges can also change their own passwords. Read this documentation on changing passwords for more details.
Details for MongoDB Credentials
-
Family: identifiers
-
Category: data_storage
-
High recall: False
-
Validity check available: True
-
Analyzer available: True
-
On-premise instances exist: False
-
Only valid secrets raise an alert: False
-
Minimum number of matches: 5
-
Occurrences found for one million commits: 5.12
-
Prefixed: False
Details for MongoDB CLI Credentials
-
Family: identifiers
-
Category: data_storage
-
Company: MongoDB
-
High recall: False
-
Validity check available: True
-
Analyzer available: True
-
On-premise instances exist: False
-
Only valid secrets raise an alert: False
-
Minimum number of matches: 3
-
Occurrences found for one million commits: 1.12
-
Prefixed: False
Details for MongoDB URI
-
Family: identifiers
-
Category: data_storage
-
Company: MongoDB
-
High recall: True
-
Validity check available: True
-
Analyzer available: True
-
On-premise instances exist: False
-
Only valid secrets raise an alert: False
-
Minimum number of matches: 5
-
Occurrences found for one million commits: 1236.02
-
Prefixed: True
Secret Analyzer
Analysis Method
- Provider allows scopes enumeration: False
- Total network call count: 10
- Total call count may vary: True
HTTP Calls
Requests are designed to capture metadata and not to function effectively. No HTTP calls for this analyzer.
Other Calls
Non-HTTP queries or HTTP calls made through a third-party app (e.g., Python package).
pymongo.MongoClient.get_database
pymongo.MongoClient.list_database_names
pymongo.synchronous.database::Database.command('usersInfo')
