HashiCorp Vault

Default Port: 8200

HashiCorp Vault stores and brokers access to secrets, credentials, certificates, and encryption keys. In pentests, exposed Vault APIs, leaked tokens, weak policies, and unsafe auth methods can lead to large-scale credential exposure.

Connect

HTTP API

Unauthenticated endpoints reveal health, seal, and initialization state.

curl http://target.com:8200/v1/sys/health
curl http://target.com:8200/v1/sys/seal-status
curl -k https://target.com:8200/v1/sys/health

Vault CLI

The CLI validates token scope and normal operator workflows.

export VAULT_ADDR=http://target.com:8200
vault status
export VAULT_TOKEN=TOKEN
vault token lookup

Token Header

Use X-Vault-Token to test leaked or provided tokens.

curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/auth/token/lookup-self
curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/sys/mounts

Recon

Service Detection with Nmap

Scan the Vault API port and TLS settings.

nmap -p 8200 -sV target.com
nmap -p 8200 --script http-title,http-headers target.com
nmap -p 8200 --script ssl-cert,ssl-enum-ciphers target.com

UI Discovery

The UI reveals login methods and operational state.

curl -i http://target.com:8200/ui/
httpx -u http://target.com:8200 -title -tech-detect -status-code
curl -I http://target.com:8200

Health Review

Health status shows whether Vault is active, standby, sealed, or uninitialized.

curl -s http://target.com:8200/v1/sys/health | jq
curl -s http://target.com:8200/v1/sys/seal-status | jq

Auth Method Discovery

Auth methods show how users, apps, and machines authenticate.

curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/sys/auth | jq
vault auth list

Enumeration

Token Lookup

Token lookup reveals identity, policies, TTL, and orphan status.

vault token lookup
curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/auth/token/lookup-self | jq

Secret Engine Enumeration

Mounted engines reveal where secrets, PKI, SSH, cloud, and database creds may exist.

vault secrets list
curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/sys/mounts | jq

Policy Enumeration

Policies define what a token can read, write, or administer.

vault policy list
vault policy read policy-name
curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/sys/policies/acl | jq

KV Enumeration

KV engines often store static secrets and application configs.

vault kv list secret/
vault kv get secret/app/config
curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/secret/metadata/?list=true

Audit Enumeration

Audit devices show whether secret access is logged.

vault audit list
curl -H "X-Vault-Token: TOKEN" http://target.com:8200/v1/sys/audit | jq

Attack Vectors

Leaked Vault Token

Vault tokens are commonly found in env files, CI configs, and app configs.

rg -n 'VAULT_TOKEN|X-Vault-Token|vault token|vault_addr|VAULT_ADDR' .
vault token lookup

Overbroad Policy

Policies with broad read, list, sudo, or wildcard paths expose secrets.

vault token capabilities secret/
vault token capabilities secret/app/config
vault policy read policy-name

KV Secret Exposure

KV paths may contain API keys, database passwords, and cloud credentials.

vault kv list secret/
vault kv get secret/app/config
vault kv get -format=json secret/app/config | jq

AppRole Abuse

Leaked RoleID and SecretID can authenticate machines or CI jobs.

vault write auth/approle/login role_id=ROLE_ID secret_id=SECRET_ID
curl -X POST -d '{"role_id":"ROLE_ID","secret_id":"SECRET_ID"}' http://target.com:8200/v1/auth/approle/login

Cloud Secret Abuse

Cloud secret engines may generate valid cloud credentials.

vault read aws/creds/role-name
vault read database/creds/role-name

PKI Abuse

PKI engines may issue certificates for sensitive names.

vault write pki/issue/role-name common_name=admin.internal ttl=1h

Post-Exploitation

Secret Inventory

Document accessible mounts, policies, and paths.

vault secrets list > vault-mounts.txt
vault policy list > vault-policies.txt
vault token lookup > vault-token.txt

Credential Review

Review only scoped secrets and request rotation for exposed credentials.

vault kv get -format=json secret/app/config > vault-secret-sample.json
grep -Ei 'password|secret|token|apikey|aws|jdbc|private' vault-secret-sample.json

Audit Check

Generate controlled reads and confirm they are logged.

vault kv get secret/pentest-log-check
vault audit list

Useful Tools

Tool	Purpose
vault	Native CLI
curl	API testing
jq	JSON parsing
nmap	Port and TLS checks
httpx	UI fingerprinting
rg	Token searching

Security Misconfigurations

Misconfiguration	Risk
Vault exposed broadly	Secret management attack surface
Leaked token	Direct secret access
Overbroad policies	Excessive secret read/write
Weak auth methods	Token issuance abuse
KV secrets unmanaged	Static credential exposure
PKI roles too broad	Unauthorized certificate issuance
Audit disabled	Secret access blind spots
Plain HTTP	Token capture risk