+================================================================+
|     MongoBleed Scanner v1.3.0                                  |
|     CVE-2025-14847 - MongoDB Memory Leak Vulnerability         |
+================================================================+

# Default port (27017)
python scanner.py -t 192.168.1.100

# Custom port
python scanner.py -t 192.168.1.100:27018

# Comma-separated
python scanner.py -t 192.168.1.100,192.168.1.101:27018,db.example.com

# targets.txt (one per line, # for comments)
# 192.168.1.100
# 192.168.1.101:27018
# mongodb.example.com

python scanner.py -f targets.txt

# Plain text
python scanner.py -t 192.168.1.100 -o report.txt

# JSON (detailed)
python scanner.py -t 192.168.1.100 -o report.json

# CSV (spreadsheet)
python scanner.py -t 192.168.1.100 -o report.csv

+================================================================+
|     MongoBleed Scanner v1.3.0                                  |
|     CVE-2025-14847 - MongoDB Memory Leak Vulnerability         |
+================================================================+
|  LEGAL: Authorized security testing only. Obtain permission    |
|         before scanning systems you do not own.                |
+================================================================+

[*] Loaded 4 target(s)

SCAN RESULTS:
----------------------------------------------------------------------
  [!] 192.168.1.100:27017       VULNERABLE  v8.0.16  zlib:ON  -> Update to 8.0.17
  [?!] 192.168.1.101:27018      POSSIBLY VULNERABLE  v~8.2.x  zlib:ON  -> Check version, update to 8.2.3
  [+] 192.168.1.102:27017       SAFE        v8.0.17  zlib:ON
  [~] 192.168.1.103:27017       MITIGATED   v8.0.16  zlib:OFF  (zlib disabled)

======================================================================
  SCAN SUMMARY
======================================================================
  Total targets scanned:  4
  Reachable:              4
  Unreachable:            0
----------------------------------------------------------------------
  [!]  VULNERABLE:        1
  [?!] POSSIBLY VULN:     1  (version estimated, needs verification)
  [+]  SAFE (patched):    1
  [~]  MITIGATED:         1  (vulnerable version but zlib disabled)
  [?]  UNKNOWN:           0
======================================================================

  VULNERABLE TARGETS REQUIRING IMMEDIATE ACTION:
----------------------------------------------------------------------
    192.168.1.100:27017  v8.0.16  zlib:ON  -> Upgrade to 8.0.17

1. TCP Connection
   └── Connect to MongoDB port

2. Version Detection
   ├── Send 'hello' command (get wire version, no auth required)
   └── Send 'buildInfo' command (get exact version, may need auth)

3. Compression Check
   └── Send zlib-compressed message, check if server accepts

4. Assessment
   └── Compare version + zlib status against vulnerability database

VULNERABLE = (version in vulnerable range) AND (zlib enabled)
MITIGATED  = (version in vulnerable range) AND (zlib disabled)
SAFE       = (version >= fixed version)

# mongod.conf
net:
  compression:
    compressors: snappy,zstd  # Remove 'zlib'

mongod --networkMessageCompressors snappy,zstd

THIS TOOL IS PROVIDED FOR AUTHORIZED SECURITY TESTING ONLY.

You must obtain proper authorization before scanning any systems
you do not own or have explicit written permission to test.

Unauthorized access to computer systems is illegal.

The authors assume no liability for misuse of this tool.

python scanner.py -t mongodb.example.com
if [ $? -eq 2 ]; then
    echo "ALERT: Vulnerable MongoDB detected!"
fi