tunahantekeoglu/mongodeepdiveContext-Aware Memory Leak Scanner & Exploit for CVE-2025-14847.
Context-Aware MongoDB Wire Protocol Exploit (CVE-2025-14847) > Advanced Heuristics Analyzer for Red Team Operations
MongoDeepDive is a high-performance, asynchronous vulnerability scanner and forensic analyzer designed to detect uninitialized memory leaks in MongoDB servers affected by CVE-2025-14847.
Unlike standard PoC scripts that merely check for response size, MongoDeepDive employs Shannon Entropy analysis and heuristic filtering to distinguish between empty memory padding (garbage) and high-value secrets (e.g., Private Keys, AWS Tokens, Passwords).
This tool is engineered for Security Architects and Red Teamers who need actionable intelligence, not just noise.
────────────────────────── MongoDeepDive - Tunahan Tekeoğlu ──────────────────────────
Scanning... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:02
[+] VULNERABLE: 192.168.1.15:27017 | Response Size: 65552 bytes
└── SECRETS FOUND: 3 critical blocks extracted
➜ SECRET_EXPOSED (AWS_KEY)
➜ HIGH_ENTROPY (Key/Encrypted)
➜ SECRET_EXPOSED (DB_URI)
[+] VULNERABLE: 192.168.1.18:27017 | Response Size: 65552 bytes
└── Leak confirmed, but memory content is currently empty/low-entropy.
Scan Complete. Report saved to mongo_audit.json
--safe flag for throttled, production-safe scanning.# Clone the repository
git clone https://github.com/tunahantekeoglu/MongoDeepDive.git
# Enter the directory
cd MongoDeepDive
# Install dependencies
pip install -r requirements.txt
(Note: Requires rich library for CLI visualization)
Scan a list of targets with high concurrency and generate a JSON report:
python3 mongo_deep_dive.py -l targets.txt -o report.json -c 50
Aggressively siphon memory from a confirmed target to hunt for secrets (e.g., sending 1000 packets):
python3 mongo_deep_dive.py -t 192.168.1.10 -n 1000
Enable throttling to avoid network saturation or service instability on legacy systems:
python3 mongo_deep_dive.py -l targets.txt --safe
OP_COMPRESSED packet with a spoofed uncompressed size.AKIA... (AWS Keys) or eyJ... (JWTs).For Educational and Authorized Testing Purposes Only.
This tool is intended for security research, authorized Red Team engagements, and vulnerability assessment. The author takes no responsibility for the misuse of this code. Accessing computer systems without permission is illegal.
Author: Tunahan Tekeoğlu
