Need help with NoSQLAttack?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

youngyangyang04
169 Stars 61 Forks GNU General Public License v3.0 98 Commits 0 Opened issues

Description

NoSQLAttack is an open source Python tool to automate exploit MongoDB server IP on Internet and disclose the database data by MongoDB default configuration weaknesses and injection attacks.

Services available

!
?

Need anything else?

Contributors list

# 76,195
Redis
PHP
HTML
offensi...
88 commits

中文说明

NoSQLAttack

Introduction

NoSQLAttack is an open source Python tool to automate expose MongoDB server IP on the internet and disclose the database data by MongoDB default configuration weaknesses and injection attacks. Presently, this project focuses on MongoDB.

Some attack tests are based on and extensions of follow papers * Diglossia: Detecting Code Injection Attacks with Precision and Efficiency * No SQL, No Injection? * Several thousand MongoDBs without access control on the Internet.

There are two systems for testing NoSQL injection in this project-NoSQLInjectionAttackDemo.

Background

NoSQL injection attacks, for example php array injection, javascript injection and mongo shell injection, endanger mongoDB. There are thousands of mongoDB are exposed on the internet, and hacker can download data from exposed mongoDB.

Requirements

On a Debian or Red Hat based system, NoSQLAttack's dependencies already be writen in setup.py. This project is built on Pycharm COMMUNITY 2016.1 with python 2.7.10.

Varies based on features used: * Shodan-1.5.3 * httplib2-0.9 * Python-2.7 * pymongo-2.7.2 * requests-2.5.0 * ipcalc-1.1.3 * MongoDB

Building

On Linux, it goes something like this:

bash
cd NoSQLAttack
python setup.py install

Tips

  • If after entering "python setup.py install", terminal show error information "No module named setuptools", just install setuptools. On Ubuntu, "sudo apt-get install python-setuptools", this command is useful
  • Install MongoDB for MongoDB default configuration attack.

Usage

After building, you can run NoSQLAttack like this:

bash
NoSQLAttack
Upon starting NoSQLAttack you are presented with the main menu:

```bash

    _   _       _____  _____ _                      
   | \ | |     /  ___||  _  | |                     
   |  \| | ___ \ `--. | | | | |                   
   | . ` |/ _ \ `--. \| | | | |                    
   | |\  | (_) /\__/ /\ \/' / |____          
   \_| \_/\___/\____/  \_/\_\_____/                  
                                    _          
/\      _      _                   | |  _        

/ \ | | | | ____ ___ | | / /
/ /\ \ |_ || | / _ \ / | | |/ /
/ /--\ \ | |_ | |_ | |_| | | |
| |\ \

/ / -- \ \ _\ _\ _____\ __| | | _\

NoSQLAttack-v0.2 [email protected]

1-Scan attacked IP 2-Configurate parameters 3-MongoDB Access Attacks 4-Injection Attacks x-Exit ```

videos

NoSQLAttack Demo for MongoDB.

(1)default configuration Attacks demo (2)injection attacks demo

NoSQLAttack MongoDB default configuration Attacks demo NoSQLAttack MongoDB default configuration Attacks demo

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.