pentest-kibana

name	pentest-kibana
description	How to pentest Kibana instances on port 5601. Use this skill whenever you need to assess Kibana security, enumerate Kibana services, check for authentication bypass, explore Elasticsearch data through Kibana, or identify vulnerabilities in the Elastic Stack. Trigger this skill for any Kibana-related security assessment, port 5601 enumeration, or Elastic Stack penetration testing.

Pentesting Kibana (Port 5601)

Kibana is the visualization and search interface for Elasticsearch, typically running on port 5601. It provides monitoring, management, and security functions for the Elastic Stack. This skill guides you through assessing Kibana security.

Reconnaissance

Initial Discovery

1. Check if Kibana is accessible

   curl -I http://<target>:5601
   curl -I https://<target>:5601
   

2. Identify the Kibana version

   • Check the response headers for version information
   • Look at the HTML source for version strings
   • Use tools like whatweb or nmap scripts

3. Check for SSL/TLS configuration

   • If SSL is disabled, sensitive information may be transmitted in plaintext
   • Evaluate the security implications of unencrypted traffic

Authentication Assessment

Understanding the Auth Model

Kibana's authentication is inherently linked to Elasticsearch credentials:

• If Elasticsearch has authentication disabled, Kibana can be accessed without credentials
• If Elasticsearch is secured, the same credentials are required for Kibana
• User permissions are identical across both platforms

Credential Discovery

1. Check for exposed configuration files

   # Look for kibana.yml in common locations
   /etc/kibana/kibana.yml
   /opt/kibana/config/kibana.yml
   

2. Extract credentials from kibana.yml

   • Look for elasticsearch.username and elasticsearch.password
   • Note: If credentials are NOT for the kibana_system user, they may offer broader access rights
   • The kibana_system user is restricted to monitoring APIs and the .kibana index

3. Try default/weak credentials

   • elastic:changeme (common default)
   • Check for credential reuse from other services

Authentication Bypass Testing

1. Test for disabled authentication

   curl http://<target>:5601/app/kibana
   

   • If you get a successful response without credentials, authentication may be disabled

2. Check for open Elasticsearch

   • If Elasticsearch is accessible without auth, Kibana may also be vulnerable

Post-Access Actions

Once you've gained access to Kibana, prioritize these actions:

1. Explore Elasticsearch Data

• Navigate to Discover to search and view indexed data
• Look for sensitive information in logs, documents, or custom indices
• Check for credentials, API keys, or PII in the data

2. Enumerate Users and Roles

Access Stack Management → Users/Roles/API Keys to:

• List all users and their permissions
• Identify privileged accounts (admin, superuser roles)
• Check for API keys that may grant programmatic access
• Look for service accounts with elevated permissions

3. Check Version for Known Vulnerabilities

• Navigate to Stack Management → Overview to find the Kibana version
• Critical: Versions prior to 6.6.0 have a known RCE vulnerability
• Cross-reference the version with CVE databases and security advisories

4. Assess Data Access

• Determine what indices are accessible
• Check if you can read/write to sensitive indices
• Look for backup or configuration indices

Vulnerability Assessment

Known Vulnerabilities

1. Kibana RCE (pre-6.6.0)

   • Versions before 6.6.0 are vulnerable to remote code execution
   • Reference: https://insinuator.net/2021/01/pentesting-the-elk-stack/

2. Authentication Bypass

   • If Elasticsearch auth is disabled, Kibana is also vulnerable
   • Check for misconfigured xpack.security.enabled settings

3. Information Disclosure

   • Unencrypted SSL/TLS can leak sensitive data
   • Check for verbose error messages revealing system information

Reporting

Document your findings with:

• Kibana version and known vulnerabilities
• Authentication status (enabled/disabled, credential strength)
• Data exposure (what sensitive information was accessible)
• User enumeration (privileged accounts, API keys found)
• SSL/TLS configuration (encrypted or plaintext)

References

• Pentesting the ELK Stack
• Elastic Security Documentation