NoSQLMap: Open Source Databases

What is NoSQLMap?

NoSQLMap is an open source Python tool that audits and automates injection attacks against NoSQL databases and the web applications using them, built for penetration testers, bug bounty hunters and security auditors.

What it is

NoSQLMap is an offensive security tool written in Python that audits NoSQL databases and the web applications built on them, then automates injection attacks and exploits default configuration weaknesses in order to disclose or clone data. It sits in the offensive security and database tooling ecosystem as the NoSQL counterpart to sqlmap: the project is named as a tribute to Bernardo Damele and Miroslav Stampar's SQL injection tool, and its concepts extend Ming Chow's Defcon 21 presentation, "Abusing NoSQL Databases".

The problem it solves is the gap left when an application talks to MongoDB or CouchDB instead of a relational database. SQL injection tooling does not understand document queries, and default NoSQL configurations, most visibly MongoDB instances exposed without authentication, often hand over the entire data store. NoSQLMap gives a tester one menu-driven console for enumerating those databases, testing injection points in web application parameters, scanning for anonymous MongoDB access, and cloning victim databases or opening Meterpreter shells against reachable targets.

Key capabilities

Menu-driven console started with python NoSQLMap, offering 1-Set options, 2-NoSQL DB Access Attacks, 3-NoSQL Web App attacks, 4-Scan for Anonymous MongoDB Access and x-Exit.
Database access attacks against MongoDB and CouchDB, with Redis and Cassandra support listed as planned for future releases.
Anonymous MongoDB access scanning to find instances that accept unauthenticated connections.
Web application injection attacks configured through target host/IP, web application port and URI path, for example /app/acct.php?acctid=102.
Database cloning to a local default MongoDB instance via the "Set my local Mongo/Shell IP" option, plus Meterpreter shells through the Metasploit Framework with a configurable shell listener port.
Saved option files for reusing target settings, and parsing of requests saved from Burp Suite.
Docker packaging as the nosqlmap image, with a docker-compose run nosqlmap workflow.

Who uses it and how

Penetration testers auditing NoSQL deployments, using 2-NoSQL DB Access Attacks to enumerate and exploit MongoDB and CouchDB targets.
Bug bounty hunters, as the bugbounty topic indicates, attacking parameters in a live target's URI through the web application attack menu.
Web application security teams and security auditors checking whether an application backed by a NoSQL store is injectable.
Red teams needing exfiltration or post-exploitation, installing the Metasploit Framework, pointing a local MongoDB instance at the clone destination and opening Meterpreter shells against a reachable MongoDB server.

Getting started

Install with python setup.py install and then run python NoSQLMap, or build the Docker image with docker build -t nosqlmap . and run it through the provided docker-compose file. On Debian or Red Hat based systems, setup.sh can be run as root to automate dependency installation.

How it compares

The only comparable tool named in the project's own material is sqlmap, which NoSQLMap is explicitly named as a tribute to and whose attack philosophy it extends from SQL injection in relational databases to NoSQL stores. Both are open source command-line tools for offensive security work, and NoSQLMap is released under GPL-3.0, but they address different targets: sqlmap covers SQL injection while NoSQLMap focuses on MongoDB and CouchDB and the web applications that query them.

When to use it — and when not to

A self-hoster must operate a full offensive toolchain: Python 2.6 or 2.7 with PyMongo, httplib2 and urllib, the Metasploit Framework, and a local default MongoDB instance to clone databases into. Anyone needing Redis or Cassandra coverage should not pick it yet, since those platforms are only planned, and anyone testing POST-based endpoints should look elsewhere because only GET requests are implemented. The Python 2.6/2.7 requirement is itself a maintenance concern for teams running supported Python releases.

project readme (upstream, from github) — read inline

NoSQLMap

NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases and web applications using NoSQL in order to disclose or clone data from the database.

Originally authored by @tcsstool and now maintained by @codingo_ NoSQLMap is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool sqlmap. Its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, "Abusing NoSQL Databases".

NoSQLMap MongoDB Management Attack Demo.

Screenshots

NoSQLMap

Summary

What is NoSQL?

A NoSQL (originally referring to "non SQL", "non relational" or "not only SQL") database provides a mechanism for storage and retrieval of data which is modeled in means other than the tabular relations used in relational databases. Such databases have existed since the late 1960s, but did not obtain the "NoSQL" moniker until a surge of popularity in the early twenty-first century, triggered by the needs of Web 2.0 companies such as Facebook, Google, and Amazon.com. NoSQL databases are increasingly used in big data and real-time web applications. NoSQL systems are also sometimes called "Not only SQL" to emphasize that they may support SQL-like query languages.

DBMS Support

Presently the tool's exploits are focused around MongoDB, and CouchDB but additional support for other NoSQL based platforms such as Redis, and Cassandra are planned in future releases.

Requirements

On a Debian or Red Hat based system, the setup.sh script may be run as root to automate the installation of NoSQLMap's dependencies.

Varies based on features used:

Metasploit Framework,
Python with PyMongo,
httplib2,
and urllib available.
A local, default MongoDB instance for cloning databases to. Check here for installation instructions.

There are some various other libraries required that a normal Python installation should have readily available. Your milage may vary, check the script.

Setup

python setup.py install

Alternatively you can build a Docker image by entering:

docker build -t nosqlmap .

or you can use Docker-compose to run Nosqlmap:

docker-compose build
docker-compose run nosqlmap

Usage Instructions

Start with

python NoSQLMap

NoSQLMap uses a menu based system for building attacks. Upon starting NoSQLMap you are presented with with the main menu:

1-Set options (do this first)
2-NoSQL DB Access Attacks
3-NoSQL Web App attacks
4-Scan for Anonymous MongoDB Access
x-Exit

Explanation of options:

1. Set target host/IP-The target web server (i.e. www.google.com) or MongoDB server you want to attack.
2. Set web app port-TCP port for the web application if a web application is the target.
3. Set URI Path-The portion of the URI containing the page name and any parameters but NOT the host name (e.g. /app/acct.php?acctid=102).
4. Set HTTP Request Method (GET/POST)-Set the request method to a GET or POST; Presently only GET is implemented but working on implementing POST requests exported from Burp.
5. Set my local Mongo/Shell IP-Set this option if attacking a MongoDB instance directly to the IP of a target Mongo installation to clone victim databases to or open Meterpreter shells to.
6. Set shell listener port-If opening Meterpreter shells, specify the port.
7. Load options file-Load a previously saved set of settings for 1-6.
8. Load options from saved Burp request-Parse a request saved from Burp Suite and populate the web application options.
9. Save options file-Save settings 1-6 for future use.
x. Back to main menu-Use this once the options are set to start your attacks.

Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate for whether you are attacking a NoSQL management port or web application. The rest of the tool is "wizard" based and fairly self explanatory, but send emails to [email protected] or find me on Twitter @codingo_ if you have any questions or suggestions.

Vulnerable Applications

This repo also includes an intentionally vulnerable web application to test NoSQLMap with. To run this application, you need Docker installed. Then you can run the following commands from the /vuln_apps directory.

docker-compose build && docker-compose up

Once that is complete, you should be able to access the vulnerable application by visiting: https://127.0.0.1:8080/index.html

Scripting

The cli can also be scripted. Here's an example script using NoSQLMap to detect the vulnerabilities in vuln_apps:

$ echo  "1. Account Lookup (acct.php)"
$ docker-compose run --remove-orphans nosqlmap \
    --attack 2 \
    --victim host.docker.internal \
    --webPort 8080 \
    --uri "/acct.php?acctid=test" \
    --httpMethod GET \
    --params 1 \
    --injectSize 4 \
    --injectFormat 2 \
    --doTimeAttack n

$ echo "2. User Data Lookup (userdata.php) - JavaScript Injection"
$ docker-compose run --remove-orphans nosqlmap \
    --attack 2 \
    --victim host.docker.internal \
    --webPort 8080 \
    --uri "/userdata.php?usersearch=test" \
    --httpMethod GET \
    --params 1 \
    --injectSize 4 \
    --injectFormat 2 \
    --doTimeAttack n

$ echo "3. Order Data Lookup (orderdata.php) - JavaScript Injection"
$ docker-compose run --remove-orphans nosqlmap \
    --attack 2 \
    --victim host.docker.internal \
    --webPort 8080 \
    --uri "/orderdata.php?ordersearch=test" \
    --httpMethod GET \
    --params 1 \
    --injectSize 4 \
    --injectFormat 2 \
    --doTimeAttack n

Frequently asked questions

Is NoSQLMap free to use?

NoSQLMap is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does NoSQLMap do?

Automated NoSQL database enumeration and web application exploitation tool.

What is NoSQLMap written in?

NoSQLMap is primarily written in Python. Its source is publicly available at https://github.com/codingo/NoSQLMap, and it has 3,350 GitHub stars.