NoSQLi – NoSql Injection CLI Tool

NoSQL scanner and injector.

About Nosqli

I wanted a better nosql injection resource that was basic to use, thoroughly command line based mostly, and configurable. To that close, I began get the job done on nosqli – a basic nosql injection instrument published in Go.

It aims to be rapidly, precise, and very usable, with an straightforward to recognize command line interface.

Features

Nosqli presently supports nosql injection detection for Mongodb. It runs the subsequent assessments:

• Mistake based – inject a wide range of people and payloads, exploring responses for identified Mongo faults
• Boolean Blind injection – inject parameters with accurate/false payloads and attempt to determine if an injection exists
• Timing injection – attempt to inject timing delays in the server, to evaluate the response.

Installation

Download the most up-to-date binary edition for your OS, and install it in your path, or run from a local folder.

Roadmap

I approach to add knowledge extraction attributes. If you would like to see other attributes or configuration options, you should open up a pull request or situation!

Using nosqli

It should be self-documented by merely running the command and studying the assist information.

$ nosqli
NoSQLInjector is a CLI software for testing Datastores that 
do not depend on SQL as a question language. 

nosqli aims to be a simple automation software for identifying and exploiting 
NoSQL Injection vectors.

Usage:
  nosqli [command]

Obtainable Commands:
  support        Help about any command
  scan        Scan endpoint for NoSQL Injection vectors
  variation     Prints the current edition

Flags:
      --config string       config file (default is $Home/.nosqli.yaml)
  -d, --knowledge string         Specify default write-up facts (should really not incorporate any injection strings)
  -h, --aid                aid for nosqli
  -p, --proxy string        Proxy requests by means of this proxy URL. Defaults to HTTP_PROXY environ   ment variable.
  -r, --ask for string      Load in a ask for from a file, these as a ask for created in Burp or ZAP.
  -t, --concentrate on string       target url eg. http://web site.com/webpage?arg=1
  -u, --person-agent string   Specify a consumer agent

Use "nosqli [command] --help" for extra information about a command.

$ nosqli scan -t http://localhost:4000/user/lookup?username=exam
Functioning Mistake based mostly scan...
Jogging Boolean dependent scan...
Discovered Error primarily based NoSQL Injection:
  URL: http://localhost:4000/user/lookup?=&username=exam
  param: username
  Injection: username="

You can exam the software utilizing my susceptible node js app, or other nosql injection labs.

Developing from supply

If you choose to build from source, or there isn”t a compiled binary for your platform, you can do so by cloning the repository, setting up dependencies, and building the challenge manually. This will require a recent Go edition, and the suitable GOPATH atmosphere variable.

$ git clone https://github.com/Charlie-belmer/nosqli
$ cd nosqli
$ go get ./..
$ go install
$ nosqli -h

Jogging Tests

There is a decent take a look at suite included. Unit tests together with straightforward injection protection can be operate by working with go examination from the root directory:

go exam ./...

Integration checks are also readily available which run injections against identified susceptible apps running domestically. To use integration assessments, install and operate the susceptible nodejs Mongo injection application and my vulnerable PHP lab fork from digininja. Then go in the integrations flag:

go exam ./... -args -integrations=real

If possibly surroundings is not identified, integration tests will be disabled by just one of the check instances, to speed the exam operate.

Contributing

Contributions are welcome! Make sure you submit a pull request or open up an situation for discussion.

Contributors License

Unless of course you specify normally, it is comprehended that you are presenting the nosqli venture the limitless, non-exclusive right to reuse, modify, and relicense the code you add. This job will normally be obtainable Open up Source, but this is vital for the reason that the incapability to relicense code has brought about devastating difficulties for other Free of charge Software program assignments (such as KDE and NASM). If you would like to specify particular license ailments of your contributions, just say so when you deliver them.

Picture and Article Resource url

Browse Additional on Pentesting Instruments