# Pentest Kibana

> How to pentest Kibana instances on port 5601. Use this skill whenever you need to assess Kibana security, enumerate Kibana services, check for authentication bypass, explore Elasticsearch data through Kibana, or identify vulnerabilities in the Elastic Stack. Trigger this skill for any Kibana-related security assessment, port 5601 enumeration, or Elastic Stack penetration testing.

- Skill: `abelrguezr/pentest-kibana` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/pentest-kibana`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/pentest-kibana/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/pentest-kibana

---


# Pentesting Kibana (Port 5601)

Kibana is the visualization and search interface for Elasticsearch, typically running on port **5601**. It provides monitoring, management, and security functions for the Elastic Stack. This skill guides you through assessing Kibana security.

## Reconnaissance

### Initial Discovery

1. **Check if Kibana is accessible**
   ```bash
   curl -I http://<target>:5601
   curl -I https://<target>:5601
   ```

2. **Identify the Kibana version**
   - Check the response headers for version information
   - Look at the HTML source for version strings
   - Use tools like `whatweb` or `nmap` scripts

3. **Check for SSL/TLS configuration**
   - If SSL is disabled, sensitive information may be transmitted in plaintext
   - Evaluate the security implications of unencrypted traffic

## Authentication Assessment

### Understanding the Auth Model

Kibana's authentication is **inherently linked to Elasticsearch credentials**:

- If Elasticsearch has authentication **disabled**, Kibana can be accessed without credentials
- If Elasticsearch is **secured**, the same credentials are required for Kibana
- User permissions are **identical** across both platforms

### Credential Discovery

1. **Check for exposed configuration files**
   ```bash
   # Look for kibana.yml in common locations
   /etc/kibana/kibana.yml
   /opt/kibana/config/kibana.yml
   ```

2. **Extract credentials from kibana.yml**
   - Look for `elasticsearch.username` and `elasticsearch.password`
   - Note: If credentials are NOT for the `kibana_system` user, they may offer **broader access rights**
   - The `kibana_system` user is restricted to monitoring APIs and the `.kibana` index

3. **Try default/weak credentials**
   - `elastic:changeme` (common default)
   - Check for credential reuse from other services

### Authentication Bypass Testing

1. **Test for disabled authentication**
   ```bash
   curl http://<target>:5601/app/kibana
   ```
   - If you get a successful response without credentials, authentication may be disabled

2. **Check for open Elasticsearch**
   - If Elasticsearch is accessible without auth, Kibana may also be vulnerable

## Post-Access Actions

Once you've gained access to Kibana, prioritize these actions:

### 1. Explore Elasticsearch Data

- Navigate to **Discover** to search and view indexed data
- Look for sensitive information in logs, documents, or custom indices
- Check for credentials, API keys, or PII in the data

### 2. Enumerate Users and Roles

Access **Stack Management** → **Users/Roles/API Keys** to:

- **List all users** and their permissions
- **Identify privileged accounts** (admin, superuser roles)
- **Check for API keys** that may grant programmatic access
- **Look for service accounts** with elevated permissions

### 3. Check Version for Known Vulnerabilities

- Navigate to **Stack Management** → **Overview** to find the Kibana version
- **Critical**: Versions prior to **6.6.0** have a known RCE vulnerability
- Cross-reference the version with CVE databases and security advisories

### 4. Assess Data Access

- Determine what indices are accessible
- Check if you can read/write to sensitive indices
- Look for backup or configuration indices

## Vulnerability Assessment

### Known Vulnerabilities

1. **Kibana RCE (pre-6.6.0)**
   - Versions before 6.6.0 are vulnerable to remote code execution
   - Reference: https://insinuator.net/2021/01/pentesting-the-elk-stack/

2. **Authentication Bypass**
   - If Elasticsearch auth is disabled, Kibana is also vulnerable
   - Check for misconfigured `xpack.security.enabled` settings

3. **Information Disclosure**
   - Unencrypted SSL/TLS can leak sensitive data
   - Check for verbose error messages revealing system information

## Reporting

Document your findings with:

- **Kibana version** and known vulnerabilities
- **Authentication status** (enabled/disabled, credential strength)
- **Data exposure** (what sensitive information was accessible)
- **User enumeration** (privileged accounts, API keys found)
- **SSL/TLS configuration** (encrypted or plaintext)

## References

- [Pentesting the ELK Stack](https://insinuator.net/2021/01/pentesting-the-elk-stack/)
- [Elastic Security Documentation](https://www.elastic.co/guide/en/kibana/current/security.html)