How to Find Exposed Databases Using Free OSINT Tools

June 5, 2026 • BizVuln Expert

Discover how security professionals and MSSPs can leverage free OSINT tools to locate exposed databases before attackers do. This guide covers Shodan, Censys, and manual techniques for identifying unsecured MongoDB, Elasticsearch, and Redis instances across the internet.

How to Find Exposed Databases Using Free OSINT Tools

In the modern threat landscape, exposed databases represent one of the most critical—and preventable—security vulnerabilities. Every week, security researchers and malicious actors alike discover terabytes of sensitive data leaking from misconfigured MongoDB, Elasticsearch, Redis, and PostgreSQL instances. For MSSPs and security consultants, the ability to proactively identify these exposures for clients is not just a value-add; it is a fundamental pillar of a robust security posture. This guide provides a comprehensive, step-by-step methodology for locating exposed databases using free OSINT (Open Source Intelligence) tools, enabling you to conduct reconnaissance, validate client security controls, and demonstrate tangible risk reduction.

Why Exposed Databases Matter to MSSPs

Before diving into the technical workflow, it is essential to understand the business context. A single exposed database can contain personally identifiable information (PII), financial records, authentication tokens, or proprietary intellectual property. For your clients, the consequences range from regulatory fines (GDPR, CCPA, HIPAA) to irreparable reputational damage. For your MSSP, the ability to discover these exposures before a breach occurs positions you as a proactive guardian rather than a reactive incident responder. Free OSINT tools lower the barrier to entry, allowing even small security teams to conduct large-scale reconnaissance without expensive commercial licenses.

Prerequisites and Ethical Considerations

Before you begin scanning, establish a clear ethical and legal framework. Only scan networks and systems for which you have explicit written authorization, typically through a penetration testing agreement or a continuous monitoring contract. Unauthorized scanning, even with free tools, can violate computer fraud laws in many jurisdictions. For MSSP engagements, ensure your Statement of Work (SoW) explicitly covers external reconnaissance and OSINT activities. Additionally, be prepared to handle sensitive data responsibly—if you discover a live, exposed database, follow a coordinated disclosure process with the asset owner.

Tool 1: Shodan – The Search Engine for Internet-Connected Devices

Shodan is arguably the most powerful free OSINT tool for discovering exposed databases. Unlike traditional search engines that index web pages, Shodan indexes banners from services running on open ports. This makes it ideal for identifying database instances that are listening on the public internet.

Basic Shodan Queries for Databases

Shodan uses a filtering syntax that allows you to narrow results by service, port, product, and geographic location. Here are the essential queries for common database types:

• MongoDB: port:27017 "MongoDB" -authentication – This query finds MongoDB instances on the default port that are not requiring authentication. The -authentication filter excludes servers that have authentication enabled.
• Elasticsearch: port:9200 "elasticsearch" "200 OK" – This identifies Elasticsearch nodes responding to HTTP requests. A "200 OK" response often indicates the REST API is accessible without credentials.
• Redis: port:6379 "redis_version" – Redis servers often expose their version banner. Combine with "-requirepass" to find instances without a password set.
• PostgreSQL: port:5432 "PostgreSQL" "FATAL" – While PostgreSQL typically requires authentication, the banner still reveals the server version and can indicate misconfigurations.
• MySQL: port:3306 "MySQL" "caching_sha2_password" – Look for MySQL servers that respond to connection attempts, indicating they are accessible from the internet.

Advanced Shodan Filtering

To refine your results for client-specific engagements, layer additional filters:

• Geographic: country:US or city:"San Francisco"
• Organization: org:"Acme Corp" – This is particularly useful for MSSPs monitoring a specific client’s IP ranges.
• Network: net:192.168.0.0/24 – Scan a specific subnet if you know the client’s public IP allocation.
• Timestamp: timestamp:2025-03-01 – Filter for recently indexed services to ensure the data is current.

Pro Tip: Shodan’s free tier limits you to 50 results per query and 1 page of results. For deeper reconnaissance, consider using Shodan’s CLI tool or upgrading to a paid plan. However, even the free tier is sufficient for initial discovery and proof-of-concept demonstrations.

Tool 2: Censys – The Alternative with Rich Metadata

Censys is another excellent free OSINT platform that indexes internet-connected devices. It offers a more structured data model than Shodan, making it easier to query specific service attributes. Censys is particularly strong for discovering databases because it parses TLS certificates, HTTP responses, and service banners into searchable fields.

Essential Censys Queries

Censys uses a Lucene-based query syntax. Here are the equivalents for database discovery:

• MongoDB: services.service_name: "MONGODB" and services.mongodb.is_master: true – This finds MongoDB instances that are primary nodes, often more likely to contain full datasets.
• Elasticsearch: services.service_name: "ELASTICSEARCH" and services.http.response.status_code: 200 – Targets Elasticsearch nodes with an open HTTP API.
• Redis: services.service_name: "REDIS" and services.redis.require_pass: false – Directly queries for Redis instances without password protection.
• Memcached: services.service_name: "MEMCACHED" – Memcached is often overlooked but can leak cached data if exposed.

Using Censys for Client-Specific Reconnaissance

Censys allows you to search by autonomous system number (ASN) or IP range. For example, if your client uses AWS, you can query autonomous_system.organization: "Amazon.com" combined with a database service filter. This helps you identify shadow IT—databases that the client’s IT team may not know are exposed.

Pro Tip: Censys provides a free API with 250 queries per month. Use the API to automate daily or weekly scans for your MSSP clients, generating alerts when new database instances appear in their IP ranges.

Tool 3: Manual Banner Grabbing with Netcat and Nmap

While Shodan and Censys provide a macro-level view, manual banner grabbing is essential for verification and deeper analysis. This approach is particularly useful when you need to confirm that a database is truly unauthenticated and accessible.

Using Netcat for Quick Checks

Netcat (nc) is a simple networking utility available on Linux and macOS. To check a specific IP and port:

echo "" | nc -w 3 203.0.113.50 27017

If the MongoDB instance is unauthenticated, you will receive a response containing the server version and a list of available databases. For Redis:

echo "INFO" | nc -w 3 203.0.113.50 6379

A successful response will return server statistics, including the number of keys and whether authentication is required.

Nmap Scripts for Database Enumeration

Nmap’s scripting engine (NSE) includes dedicated scripts for database discovery and vulnerability assessment. Run these with caution and only on authorized targets:

• MongoDB: nmap -p 27017 --script mongodb-databases 203.0.113.50 – This script attempts to list all databases on the target.
• Elasticsearch: nmap -p 9200 --script http-grep 203.0.113.50 – Use a custom grep pattern to search for "indices" in the response.
• Redis: nmap -p 6379 --script redis-info 203.0.113.50 – Retrieves Redis server information and checks for default credentials.

Pro Tip: Combine Nmap with Shodan results. Export a list of IPs from Shodan, then run targeted Nmap scans to validate the exposure and assess the volume of data at risk.

Tool 4: FOFA – The Chinese OSINT Engine

FOFA (Fingerprinting Organization with Advanced Search) is a lesser-known but highly effective OSINT engine that indexes internet-facing services. It is particularly useful for discovering databases in regions where Shodan and Censys have less coverage, such as parts of Asia and Eastern Europe.

FOFA Queries for Databases

• MongoDB: port="27017" && protocol="mongodb"
• Elasticsearch: port="9200" && body="cluster_name"
• Redis: port="6379" && protocol="redis"

FOFA’s free tier allows up to 10,000 results per query, making it more generous than Shodan for initial reconnaissance. However, the interface is less intuitive for English speakers, so plan to spend time learning the syntax.

Building a Repeatable MSSP Workflow

To operationalize these tools for your MSSP practice, follow this structured workflow:

1. Define the Scope: Identify the client’s public IP ranges, ASNs, and known cloud providers. Use WHOIS and BGP tools to map their internet footprint.
2. Run Automated Queries: Use Shodan and Censys APIs to query for all database types within the client’s scope. Schedule these queries weekly.
3. Validate Findings: For each potential exposure, use Netcat or Nmap to confirm the database is accessible without credentials. Document the response banners.
4. Assess Data Sensitivity: If the database is truly exposed, attempt to enumerate database names or indices. Do not download or exfiltrate data—simply note the presence of sensitive-sounding names (e.g., "customers", "payments", "users").
5. Report and Remediate: Provide the client with a prioritized list of exposures, including IP addresses, database types, and evidence of unauthenticated access. Recommend immediate firewall rules, authentication enforcement, and VPN-only access.
6. Monitor Continuously: Set up recurring scans using cron jobs or a SIEM integration. Alert the client when new database instances appear or when previously secured databases become exposed again.

Common Pitfalls and How to Avoid Them

Even experienced security professionals can make mistakes during OSINT reconnaissance. Here are the most common pitfalls:

• False Positives: Shodan and Censys may index services that are no longer active. Always validate with a live connection before reporting.
• Rate Limiting: Free tiers of these tools have strict rate limits. Spread your queries over time or use multiple accounts for larger engagements.
• Legal Exposure: Scanning without authorization is illegal in many jurisdictions. Always have a signed agreement that explicitly covers external reconnaissance.
• Data Handling: If you accidentally access sensitive data, do not store it. Document the exposure and immediately notify the client through your pre-agreed disclosure channel.

Conclusion: From Discovery to Protection

Finding exposed databases using free OSINT tools is a critical skill for any MSSP or security consultant. Shodan, Censys, FOFA, and manual banner grabbing tools provide a powerful arsenal for discovering misconfigured MongoDB, Elasticsearch, Redis, and other database instances before attackers do. By integrating these tools into a repeatable workflow, you can offer your clients continuous monitoring, rapid incident response, and demonstrable risk reduction. Remember, the goal is not just to find exposures—it is to close them. Use these techniques to build trust, demonstrate expertise, and ultimately make the internet a slightly more secure place, one database at a time.

BizVuln helps MSSPs automate this entire workflow. Our platform integrates with Shodan, Censys, and custom Nmap scans to provide a unified dashboard for exposed database discovery, risk scoring, and client reporting. Contact us for a demo.