HTB STARTING POINT · Tier 0

Mongod

MongoDB 3.6.8 without bind authentication exposes a sensitive_information database; the real lesson is why auth-on-by-default matters.…

April 27, 2026 · 5 min · crAIzy
MongoDB No-Auth

HTB STARTING POINT · Tier 2

Unified

Log4Shell in UniFi Network Application 6.4.54 — JNDI in the remember field hands over shell as root. MongoDB's default no-auth exposes admin password hash, cracked in seconds.…

April 27, 2026 · 4 min · crAIzy
Log4ShellNoSQL Enum