Databases & cachesTCP 9200 Encrypted
Port 9200: Elasticsearch
Elasticsearch REST API
The HTTP API for Elasticsearch clusters (9300 is node-to-node transport).
How attackers abuse it
- Clusters left open to the internet leaking whole datasets.
How to defend it
- Keep security features enabled (authentication and TLS); never expose 9200 publicly.
Exam tip
Many large data leaks were simply open search clusters, not sophisticated hacks.