From 7632885bd3e3981e7e3e1ddd1963ee166b79d1b2 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:30:33 +0700 Subject: [PATCH 01/11] reformat the README to markdown --- README => README.md | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) rename README => README.md (90%) diff --git a/README b/README.md similarity index 90% rename from README rename to README.md index e6463fc..ad9a6a7 100644 --- a/README +++ b/README.md @@ -1,23 +1,42 @@ -NoSQLMap v0.1 +NoSQLMap +======== + +v0.1 http://www.nosqlmap.net -Introduction: +Introduction +============ + NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool SQLmap, and its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, "Abusing NoSQL Databases". Presently the tool's exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases. -Requirements (Varies based on features used): --Python with PyMongo, httplib2, and urllib available; There are some various other libraries required that a normal Python installation should have readily available. Your milage may vary, check the script. +Requirements +============ +Varies based on features used: +-Python with PyMongo, httplib2, and urllib available; There are some various other libraries required that a normal Python installation should have readily available. Your milage may vary, check the script. -Metasploit Framework Usage: --Start with ./nosqlmap.py or python nosqlmap.py. +-Start with + +``` +./nosqlmap.py +``` + +or + +``` +python nosqlmap.py. +``` -NoSQLMap uses a menu based system for building attacks. Upon starting NoSQLMap you are presented with with the main menu: +``` 1-Set options (do this first) 2-NoSQL DB Access Attacks 3-NoSQL Web App attacks 4-Exit +``` ALWAYS USE OPTION 1 FIRST TO SET THE PARAMETERS! @@ -29,5 +48,6 @@ Explanation of options 5-Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. 6-Set shell listener port-If opening Meterpreter shells, specify the port. 7-Back to main menu +``` -Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter @tcstoolHax0r if you have any questions or suggestions. \ No newline at end of file +Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter @tcstoolHax0r if you have any questions or suggestions. From 80b5b1b5d6a30e05e99ccb9c07f41f771ea4d7b1 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:35:34 +0700 Subject: [PATCH 02/11] add twitter hyperlink and some fixes at README.md --- README.md | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index ad9a6a7..356b293 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,7 @@ NoSQLMap ======== -v0.1 -http://www.nosqlmap.net +[http://www.nosqlmap.net](NoSQLMap) v0.1 Introduction ============ @@ -40,14 +39,13 @@ python nosqlmap.py. ALWAYS USE OPTION 1 FIRST TO SET THE PARAMETERS! -Explanation of options -1-Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. -2-Set web app port-TCP port for the web application if a web application is the target -3-Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) -4-Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. -5-Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. -6-Set shell listener port-If opening Meterpreter shells, specify the port. -7-Back to main menu -``` +Explanation of options: +#. Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. +#. Set web app port-TCP port for the web application if a web application is the target +#. Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) +#. Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. +#. Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. +#. Set shell listener port-If opening Meterpreter shells, specify the port. +#. Back to main menu -Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter @tcstoolHax0r if you have any questions or suggestions. +Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. From ac07dcc015e93fb0c6f0b7a9c0744b8414617739 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:41:22 +0700 Subject: [PATCH 03/11] fix ordered list and add bold text at README.md --- README.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 356b293..7b81336 100644 --- a/README.md +++ b/README.md @@ -37,15 +37,15 @@ python nosqlmap.py. 4-Exit ``` -ALWAYS USE OPTION 1 FIRST TO SET THE PARAMETERS! +**ALWAYS USE OPTION 1 FIRST TO SET THE PARAMETERS!** Explanation of options: -#. Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. -#. Set web app port-TCP port for the web application if a web application is the target -#. Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) -#. Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. -#. Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. -#. Set shell listener port-If opening Meterpreter shells, specify the port. -#. Back to main menu +Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. +1 - Set web app port-TCP port for the web application if a web application is the target +2 - Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) +3 - Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. +4 - Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. +5 - Set shell listener port-If opening Meterpreter shells, specify the port. +6 - Back to main menu Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. From a83fa3399742009a6a5df463320763bb2aaba517 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:43:34 +0700 Subject: [PATCH 04/11] fix ordered list at README.md --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 7b81336..c9a7b79 100644 --- a/README.md +++ b/README.md @@ -41,11 +41,11 @@ python nosqlmap.py. Explanation of options: Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. -1 - Set web app port-TCP port for the web application if a web application is the target -2 - Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) -3 - Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. -4 - Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. -5 - Set shell listener port-If opening Meterpreter shells, specify the port. -6 - Back to main menu +1. - Set web app port-TCP port for the web application if a web application is the target +2. - Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) +3. - Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. +4. - Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. +5. - Set shell listener port-If opening Meterpreter shells, specify the port. +6. - Back to main menu Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. From 4c9114cf505d24a578c659c146af2d50aded2b48 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:44:55 +0700 Subject: [PATCH 05/11] fix ordered list at README.md --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index c9a7b79..2c2d26e 100644 --- a/README.md +++ b/README.md @@ -41,11 +41,11 @@ python nosqlmap.py. Explanation of options: Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. -1. - Set web app port-TCP port for the web application if a web application is the target -2. - Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) -3. - Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. -4. - Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. -5. - Set shell listener port-If opening Meterpreter shells, specify the port. -6. - Back to main menu +1. Set web app port-TCP port for the web application if a web application is the target +2. Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) +3. Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. +4. Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. +5. Set shell listener port-If opening Meterpreter shells, specify the port. +6. Back to main menu Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. From a0cc74a884b5eee00e2d9514f97a4ab288fbf79f Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:46:59 +0700 Subject: [PATCH 06/11] fix ordered list at README.md --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 2c2d26e..718d953 100644 --- a/README.md +++ b/README.md @@ -41,11 +41,11 @@ python nosqlmap.py. Explanation of options: Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. -1. Set web app port-TCP port for the web application if a web application is the target -2. Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) -3. Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. -4. Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. -5. Set shell listener port-If opening Meterpreter shells, specify the port. -6. Back to main menu +- Set web app port-TCP port for the web application if a web application is the target +- Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) +- Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. +- Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. +- Set shell listener port-If opening Meterpreter shells, specify the port. +- Back to main menu Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. From 1c41300b655854b6acfdb1d85eb3eaa3fdaf3c10 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:51:48 +0700 Subject: [PATCH 07/11] fix ordered list at README.md --- README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 718d953..407a89e 100644 --- a/README.md +++ b/README.md @@ -40,12 +40,12 @@ python nosqlmap.py. **ALWAYS USE OPTION 1 FIRST TO SET THE PARAMETERS!** Explanation of options: -Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. -- Set web app port-TCP port for the web application if a web application is the target -- Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102) -- Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. -- Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. -- Set shell listener port-If opening Meterpreter shells, specify the port. -- Back to main menu +1. Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. +2. Set web app port-TCP port for the web application if a web application is the target. +3. Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102). +4. Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp. +5. Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. +6. Set shell listener port-If opening Meterpreter shells, specify the port. +7. Back to main menu. Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. From 70c3fef5b303ab317abe00f9eefc1d9d9e5929c1 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 15:56:36 +0700 Subject: [PATCH 08/11] fix ordered list at README.md --- README.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 407a89e..d092756 100644 --- a/README.md +++ b/README.md @@ -6,14 +6,20 @@ NoSQLMap Introduction ============ -NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool SQLmap, and its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, "Abusing NoSQL Databases". Presently the tool's exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases. +NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. + +It is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool [http://sqlmap.org](sqlmap), and its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, "Abusing NoSQL Databases". Presently the tool's exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases. Requirements ============ Varies based on features used: --Python with PyMongo, httplib2, and urllib available; There are some various other libraries required that a normal Python installation should have readily available. Your milage may vary, check the script. --Metasploit Framework +- Metasploit Framework, +- Python with PyMongo, +- httplib2, +- and urllib available. + +There are some various other libraries required that a normal Python installation should have readily available. Your milage may vary, check the script. Usage: @@ -40,6 +46,7 @@ python nosqlmap.py. **ALWAYS USE OPTION 1 FIRST TO SET THE PARAMETERS!** Explanation of options: +``` 1. Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack. 2. Set web app port-TCP port for the web application if a web application is the target. 3. Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. acct.php?acctid=102). @@ -47,5 +54,6 @@ Explanation of options: 5. Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to. 6. Set shell listener port-If opening Meterpreter shells, specify the port. 7. Back to main menu. +``` Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. From 2ad172fcb063c009bed1e3b5045dd899ac1f395c Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 16:01:08 +0700 Subject: [PATCH 09/11] fix links at README.md --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index d092756..53730bb 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,14 @@ NoSQLMap ======== -[http://www.nosqlmap.net](NoSQLMap) v0.1 +[NoSQLMap](http://www.nosqlmap.net) v0.1 Introduction ============ NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. -It is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool [http://sqlmap.org](sqlmap), and its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, "Abusing NoSQL Databases". Presently the tool's exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases. +It is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool [sqlmap](http://sqlmap.org), and its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, "Abusing NoSQL Databases". Presently the tool's exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases. Requirements ============ @@ -56,4 +56,4 @@ Explanation of options: 7. Back to main menu. ``` -Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [https://twitter.com/tcstoolHax0r](@tcstoolHax0r) if you have any questions or suggestions. +Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. Send emails to tcstool@gmail.com or find me on Twitter [@tcstoolHax0r](https://twitter.com/tcstoolHax0r) if you have any questions or suggestions. From 36dfd4e330df478755e3926f4c2839111daaa45d Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 16:02:15 +0700 Subject: [PATCH 10/11] change requirement to heading at README.md --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 53730bb..594ace8 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,8 @@ Varies based on features used: There are some various other libraries required that a normal Python installation should have readily available. Your milage may vary, check the script. -Usage: +Usage +===== -Start with From 1e6bce37ff8d535e1aa12c5d4b4f0e38a227b516 Mon Sep 17 00:00:00 2001 From: za Date: Fri, 8 Nov 2013 16:03:06 +0700 Subject: [PATCH 11/11] delete - at README.md --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 594ace8..114c55d 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,8 @@ or ``` python nosqlmap.py. ``` --NoSQLMap uses a menu based system for building attacks. Upon starting NoSQLMap you are presented with with the main menu: + +NoSQLMap uses a menu based system for building attacks. Upon starting NoSQLMap you are presented with with the main menu: ``` 1-Set options (do this first)