29 lines
1.8 KiB
Markdown
29 lines
1.8 KiB
Markdown
# 5601 - Pentesting Kibana
|
|
|
|
## Basic Information
|
|
|
|
Kibana provides search and data visualization capabilities for data indexed in Elasticsearch. The service runs per default on port **5601**. Kibana also acts as the user interface for monitoring, managing, and securing an Elastic Stack cluster.
|
|
|
|
### Authentication?
|
|
|
|
Authentication in Kibana is linked to the **credentials from** [**Elasticsearch**](9200-pentesting-elasticsearch.md). If **authentication** is **disabled** in **Elasticsearch**, **Kibana** also should be **accessible without credentials**. Otherwise the **same credentials valid for Elasticsearch** should be working when logging in to Kibana. The **rights** of the **users** in **Elasticsearch** are the **same** as in **Kibana**.
|
|
|
|
You might find credentials in the configuration file **/etc/kibana/kibana.yml**. If those credentials are not for the user **kibana\_system**, it should be tried to use them for accessing further data. They could have more rights then the **kibana\_system** user, which only has access to the monitoring API and the **.kibana** index.
|
|
|
|
### Having Access?
|
|
|
|
When having access to Kibana you can do several things:
|
|
|
|
* Try to **access data** from **Elasticsearch**
|
|
* Check if you can access the users panel and if you can e**dit, delete or create new users,** roles or API Keys \(Stack Management -> Users/Roles/API Keys\)
|
|
* Check the current version for vulnerabilities \(**There was a RCE vulnerability in 2019 for Kibana versions < 6.6.0** \[[2](https://insinuator.net/2021/01/pentesting-the-elk-stack/#ref2)\]\)
|
|
|
|
### Enabled SSL/TLS?
|
|
|
|
If SSL/TLS is not enabled, it should be evaluated, whether sensitive information can be leaked.
|
|
|
|
### References
|
|
|
|
* [https://insinuator.net/2021/01/pentesting-the-elk-stack/](https://insinuator.net/2021/01/pentesting-the-elk-stack/)
|
|
|