+================================================================+
|     MongoBleed Scanner v1.3.0                                  |
|     CVE-2025-14847 - MongoDB Memory Leak Vulnerability         |
+================================================================+

# المنفذ الافتراضي (27017)
python scanner.py -t 192.168.1.100

# منفذ مخصص
python scanner.py -t 192.168.1.100:27018

# مفصولة بفواصل
python scanner.py -t 192.168.1.100,192.168.1.101:27018,db.example.com

# targets.txt (واحد لكل سطر، # للتعليقات)
# 192.168.1.100
# 192.168.1.101:27018
# mongodb.example.com

python scanner.py -f targets.txt

# نص عادي
python scanner.py -t 192.168.1.100 -o report.txt

# JSON (مفصل)
python scanner.py -t 192.168.1.100 -o report.json

# CSV (جدول بيانات)
python scanner.py -t 192.168.1.100 -o report.csv

+================================================================+
|     MongoBleed Scanner v1.3.0                                  |
|     CVE-2025-14847 - MongoDB Memory Leak Vulnerability         |
+================================================================+
|  LEGAL: Authorized security testing only. Obtain permission    |
|         before scanning systems you do not own.                |
+================================================================+

[*] Loaded 4 target(s)

SCAN RESULTS:
----------------------------------------------------------------------
  [!] 192.168.1.100:27017       VULNERABLE  v8.0.16  zlib:ON  -> Update to 8.0.17
  [?!] 192.168.1.101:27018      POSSIBLY VULNERABLE  v~8.2.x  zlib:ON  -> Check version, update to 8.2.3
  [+] 192.168.1.102:27017       SAFE        v8.0.17  zlib:ON
  [~] 192.168.1.103:27017       MITIGATED   v8.0.16  zlib:OFF  (zlib disabled)

======================================================================
  SCAN SUMMARY
======================================================================
  Total targets scanned:  4
  Reachable:              4
  Unreachable:            0
----------------------------------------------------------------------
  [!]  VULNERABLE:        1
  [?!] POSSIBLY VULN:     1  (version estimated, needs verification)
  [+]  SAFE (patched):    1
  [~]  MITIGATED:         1  (vulnerable version but zlib disabled)
  [?]  UNKNOWN:           0
======================================================================

  VULNERABLE TARGETS REQUIRING IMMEDIATE ACTION:
----------------------------------------------------------------------
    192.168.1.100:27017  v8.0.16  zlib:ON  -> Upgrade to 8.0.17

1. TCP Connection
   └── Connect to MongoDB port

2. Version Detection
   ├── Send 'hello' command (get wire version, no auth required)
   └── Send 'buildInfo' command (get exact version, may need auth)

3. Compression Check
   └── Send zlib-compressed message, check if server accepts

4. Assessment
   └── Compare version + zlib status against vulnerability database

VULNERABLE = (version in vulnerable range) AND (zlib enabled)
MITIGATED  = (version in vulnerable range) AND (zlib disabled)
SAFE       = (version >= fixed version)

# mongod.conf
net:
  compression:
    compressors: snappy,zstd  # Remove 'zlib'

mongod --networkMessageCompressors snappy,zstd

THIS TOOL IS PROVIDED FOR AUTHORIZED SECURITY TESTING ONLY.

You must obtain proper authorization before scanning any systems
you do not own or have explicit written permission to test.

Unauthorized access to computer systems is illegal.

The authors assume no liability for misuse of this tool.

python scanner.py -t mongodb.example.com
if [ $? -eq 2 ]; then
    echo "ALERT: Vulnerable MongoDB detected!"
fi