NoSQLi – NoSql Injection CLI Tool

NoSQLi – NoSql Injection CLI Tool

NoSQL scanner and injector.

About Nosqli

I wanted a better nosql injection resource that was basic to use, thoroughly command line based mostly, and configurable. To that close, I began get the job done on nosqli – a basic nosql injection instrument published in Go.

It aims to be rapidly, precise, and very usable, with an straightforward to recognize command line interface.

Features

Nosqli presently supports nosql injection detection for Mongodb. It runs the subsequent assessments:

  • Mistake based – inject a wide range of people and payloads, exploring responses for identified Mongo faults
  • Boolean Blind injection – inject parameters with accurate/false payloads and attempt to determine if an injection exists
  • Timing injection – attempt to inject timing delays in the server, to evaluate the response.

Installation

Download the most up-to-date binary edition for your OS, and install it in your path, or run from a local folder.

Roadmap

I approach to add knowledge extraction attributes. If you would like to see other attributes or configuration options, you should open up a pull request or situation!

Using nosqli

It should be self-documented by merely running the command and studying the assist information.

$ nosqli
NoSQLInjector is a CLI software for testing Datastores that
do not depend on SQL as a question language.

nosqli aims to be a simple automation software for identifying and exploiting
NoSQL Injection vectors.

Usage:
nosqli [command]

Obtainable Commands:
support Help about any command
scan Scan endpoint for NoSQL Injection vectors
variation Prints the current edition

Flags:
--config string config file (default is $Home/.nosqli.yaml)
-d, --knowledge string Specify default write-up facts (should really not incorporate any injection strings)
-h, --aid aid for nosqli
-p, --proxy string Proxy requests by means of this proxy URL. Defaults to HTTP_PROXY environ ment variable.
-r, --ask for string Load in a ask for from a file, these as a ask for created in Burp or ZAP.
-t, --concentrate on string target url eg. http://web site.com/webpage?arg=1
-u, --person-agent string Specify a consumer agent

Use "nosqli [command] --help" for extra information about a command.

$ nosqli scan -t http://localhost:4000/user/lookup?username=exam
Functioning Mistake based mostly scan...
Jogging Boolean dependent scan...
Discovered Error primarily based NoSQL Injection:
URL: http://localhost:4000/user/lookup?=&username=exam
param: username
Injection: username="

You can exam the software utilizing my susceptible node js app, or other nosql injection labs.

Developing from supply

If you choose to build from source, or there isn”t a compiled binary for your platform, you can do so by cloning the repository, setting up dependencies, and building the challenge manually. This will require a recent Go edition, and the suitable GOPATH atmosphere variable.

$ git clone https://github.com/Charlie-belmer/nosqli
$ cd nosqli
$ go get ./..
$ go install
$ nosqli -h

Jogging Tests

There is a decent take a look at suite included. Unit tests together with straightforward injection protection can be operate by working with go examination from the root directory:

go exam ./...

Integration checks are also readily available which run injections against identified susceptible apps running domestically. To use integration assessments, install and operate the susceptible nodejs Mongo injection application and my vulnerable PHP lab fork from digininja. Then go in the integrations flag:

go exam ./... -args -integrations=real

If possibly surroundings is not identified, integration tests will be disabled by just one of the check instances, to speed the exam operate.

Contributing

Contributions are welcome! Make sure you submit a pull request or open up an situation for discussion.

Contributors License

Unless of course you specify normally, it is comprehended that you are presenting the nosqli venture the limitless, non-exclusive right to reuse, modify, and relicense the code you add. This job will normally be obtainable Open up Source, but this is vital for the reason that the incapability to relicense code has brought about devastating difficulties for other Free of charge Software program assignments (such as KDE and NASM). If you would like to specify particular license ailments of your contributions, just say so when you deliver them.

43Dzn as34k

Picture and Article Resource url

Browse Additional on Pentesting Instruments

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *

%d bloggers like this: