mongo_exposure_scanner.py
验证 Python：
python3 --version
| 文件 | 用途 |
|---|---|
mongo_scanner.py | 扫描器脚本 |
targets.txt | 目标主机和端口 |
mongo_exposed_targets.txt | 扫描结果（自动创建） |
targets.txt）支持的格式：
# Host only (default ports used)
10.99.1.52
# Host with specific port
mongo.example.com:3717
# Multiple ports
192.168.1.10:27017,28017
# Port range
172.16.0.20:27017-27030
注意：
# 行被忽略运行扫描器：
python3 mongo_scanner.py
脚本将提示：
Enter target file name (default: targets.txt):
选项：
targets.txtprod_mongo.txtpython3 mongo_scanner.py
Enter target file name (default: targets.txt): prod_mongo.txt
[*] Using target file: prod_mongo.txt
[*] Total host:port pairs: 4
[*] Concurrency: 50 | Timeout: 5s
------------------------------------------------------------
[+] MongoDB OPEN: 10.99.1.52:3717
[-] 192.168.1.10:27017 - Not exposed
------------------------------------------------------------
[*] Done. Results saved to mongo_exposed_targets.txt
mongo_exposed_targets.txt
[2026-01-20 12:34:07] 10.99.1.52:3717 - Unauthenticated MongoDB exposed
[2026-01-20 12:34:07] dds-d9j6c3a7096ded641.mongodb.ap-southeast-5.rds.aliyuncs.com:3717 - Unauthenticated MongoDB exposed
| 状态 | 含义 |
|---|---|
MongoDB OPEN | MongoDB 服务响应了 hello |
Unauthenticated MongoDB exposed | 握手在无需认证的情况下允许 |
Not exposed | 非 MongoDB 或认证/连接被阻止 |
Connection refused / timeout | 服务不可达 |