# 5601 - Pentesting Kibana

## Basic Information

Kibana provides search and data visualization capabilities for data indexed in Elasticsearch. The service runs per default on port **5601**. Kibana also acts as the user interface for monitoring, managing, and securing an Elastic Stack cluster.

### Authentication?

Authentication in Kibana is linked to the **credentials from** [**Elasticsearch**](9200-pentesting-elasticsearch.md). If **authentication** is **disabled** in **Elasticsearch**, **Kibana** also should be **accessible without credentials**. Otherwise the **same credentials valid for Elasticsearch** should be working when logging in to Kibana. The **rights** of the **users** in **Elasticsearch** are the **same** as in **Kibana**.

You might find credentials in the configuration file **/etc/kibana/kibana.yml**. If those credentials are not for the user **kibana\_system**, it should be tried to use them for accessing further data. They could have more rights then the **kibana\_system** user, which only has access to the monitoring API and the **.kibana** index.

### Having Access?

When having access to Kibana you can do several things:

* Try to **access data** from **Elasticsearch**
* Check if you can access the users panel and if you can e**dit, delete or create new users,** roles or API Keys \(Stack Management -> Users/Roles/API Keys\)
* Check the current version for vulnerabilities \(**There was a RCE vulnerability in 2019 for Kibana versions < 6.6.0** \[[2](https://insinuator.net/2021/01/pentesting-the-elk-stack/#ref2)\]\)

### Enabled SSL/TLS?

If SSL/TLS is not enabled, it should be evaluated, whether sensitive information can be leaked.

### References

* [https://insinuator.net/2021/01/pentesting-the-elk-stack/](https://insinuator.net/2021/01/pentesting-the-elk-stack/)