What is the hash function used by MongoDB to hash the database user passwords?

Question

In MongoDb use can add user to a database for access control. A user can be inserted with:

db.addUser({ user: "aaaa", pwd: "1234", roles: [...]})

and the inserted user is:

{
    "user" : "aaa",
    "pwd" : "08ccdf34dbb3ca05dcc195e30994b628",
    "roles" : [
        "userAdminAnyDatabase"
    ],
    "_id" : ObjectId("52a88b45965c4e7ad46bb97b")
}

What function does MongoDB use to compute/hash the pwd key?

Answer 1

The pwd is the hex encoding of MD5( username + ":mongo:" + password_text ).

From the official documentation.

The result does not coincide with the hash you show in your json, but I think you replaced the actual username and password anyway as you add "aaaa" but retrieve "aaa".