NoSQLAttack is an open source Python tool to automate exploit MongoDB server IP on Internet and disclose the database data by MongoDB default configuration weaknesses and injection attacks.
NoSQLAttack is an open source Python tool to automate expose MongoDB server IP on the internet and disclose the database data by MongoDB default configuration weaknesses and injection attacks. Presently, this project focuses on MongoDB.
Some attack tests are based on and extensions of follow papers * Diglossia: Detecting Code Injection Attacks with Precision and Efficiency * No SQL, No Injection? * Several thousand MongoDBs without access control on the Internet.
There are two systems for testing NoSQL injection in this project-NoSQLInjectionAttackDemo.
On a Debian or Red Hat based system, NoSQLAttack's dependencies already be writen in setup.py. This project is built on Pycharm COMMUNITY 2016.1 with python 2.7.10.
Varies based on features used: * Shodan-1.5.3 * httplib2-0.9 * Python-2.7 * pymongo-2.7.2 * requests-2.5.0 * ipcalc-1.1.3 * MongoDB
On Linux, it goes something like this:
bash cd NoSQLAttack python setup.py install
After building, you can run NoSQLAttack like this:
bash NoSQLAttackUpon starting NoSQLAttack you are presented with the main menu:
_ _ _____ _____ _ | \ | | / ___|| _ | | | \| | ___ \ `--. | | | | | | . ` |/ _ \ `--. \| | | | | | |\ | (_) /\__/ /\ \/' / |____ \_| \_/\___/\____/ \_/\_\_____/ _ /\ _ _ | | _
/ \ | | | | ____ ___ | | / /
/ /\ \ |_ || | / _ \ / | | |/ /
/ /--\ \ | |_ | |_ | |_| | | | | |\ \
NoSQLAttack-v0.2 [email protected]
1-Scan attacked IP 2-Configurate parameters 3-MongoDB Access Attacks 4-Injection Attacks x-Exit ```
NoSQLAttack Demo for MongoDB.
(1)default configuration Attacks demo (2)injection attacks demo