9042, 9160 - Pentesting Cassandra

Basic Information

Apache Cassandra is a distributed NoSQL database designed to store data across multiple nodes without a single point of failure.^[1]

The native CQL protocol listens on TCP port 9042 by default. TCP port 9160 belongs to the legacy Thrift RPC service; in Cassandra 3.11 it is disabled by default, and modern deployments normally use the native protocol.^[1]^[2]

Historically, Cassandra’s default AllowAllAuthenticator required no credentials. An exposed cluster with authentication disabled may therefore allow schema and data access, not merely credential guessing. Cassandra’s security documentation recommends configuring authentication, authorization, and encryption together.^[3]

Default/legacy ports: 9042/TCP (native CQL), 9160/TCP (legacy Thrift)

PORT     STATE SERVICE   REASON
9042/tcp open  cassandra-native Apache Cassandra 3.10 or later (native protocol versions 3/v3, 4/v4, 5/v5-beta)
9160/tcp open  cassandra syn-ack

Enumeration

Manual

cqlsh <IP> 9042

-- Basic node information
SELECT cluster_name, data_center, rack, partitioner, native_protocol_version, release_version FROM system.local;

-- Older releases may also expose Thrift-specific version information
SELECT thrift_version FROM system.local;

-- Keyspace enumeration on current releases
SELECT keyspace_name FROM system_schema.keyspaces;
SELECT keyspace_name FROM system.schema_keyspaces; -- Cassandra 2.x and older
DESCRIBE KEYSPACES;
DESCRIBE KEYSPACE <keyspace_name>;
DESCRIBE KEYSPACE system_auth;

-- Role metadata, if the connected role is authorized to read it
SELECT role, is_superuser, can_login FROM system_auth.roles;
SELECT * FROM system_auth.roles;  -- May include password hashes in the configured backend

-- Application-specific tables discovered during keyspace enumeration
SELECT * FROM logdb.user_auth;
SELECT * FROM logdb.user;
SELECT * FROM configuration."config";

The logdb and configuration queries are examples from real deployments, not built-in Cassandra schemas. Run them only if enumeration shows those keyspaces and tables; otherwise, adapt the query to the application’s discovered schema.

cqlsh ships with Cassandra and connects to one specified node through the native protocol. If the matching client is not otherwise available, a standalone package can be installed with python3 -m pip install cqlsh, but compatibility is guaranteed only between the cqlsh version and the Cassandra version with which it was released.^[4][6]

Automated

Nmap’s cassandra-info script attempts to retrieve basic server status. Its documented example targets the legacy Thrift service on port 9160, so it is not a replacement for CQL enumeration on port 9042.^[5]

nmap -sV --script cassandra-info -p <PORT> <IP>

Brute force

Shodan

port:9160 Cluster
port:9042 "Invalid or unsupported protocol version"