Nosql Exploitation Framework

The Tool focuses on scanning and exploiting NoSQL Databases which makes the pentesters life easy. The tool currently has support for Mongo,Couch-db and Redis,with further additions to be made soon.It supports Enumerating NoSQL Db’s,Dumping Nosql db’s,Dictionary attacks and Shodan Search...

600TB MongoDB Database 'accidentally' exposed on the Internet

System administrators have reportedly exposed almost 600 Terabytes TB of MongoDB database due to running outdated and unpatched versions of the NoSQL MongoDB database. The open source MongoDB is the most popular NoSQL database used by companies of all sizes, from eBay and Sourceforge to The New...

NoPo - NoSQL Honeypot Framework

NoSQL-Honeypot-Framework NoPo is an open source honeypot for nosql databases that automates the process of detecting attackers,logging attack incidents. The simulation engines are deployed using the twisted framework.Currently the framework holds support for redis. N.B : The framework is under...

CVE-2015-1937

IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a sessio...

Authentication flaw

IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a sessio...

CVE-2015-1937

CVE-2015-1937 affects IBM PowerVC: the ceilometer NoSQL database in PowerVC 1.2.0.x (1.2.0.4 and earlier), 1.2.1.x (up to 1.2.1.2), and 1.2.2.x (up to 1.2.2.2) allows remote unauthenticated access via port 27017, enabling reading/writing arbitrary database records and potentially gaining administ...

CVE-2015-1937

IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a sessio...

CVE-2015-1937: Improper Access Control

IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a sessio...

PT-2015-5511

Name of the Vulnerable Software and Affected Versions IBM PowerVC versions 1.2.0.x through 1.2.0.4 IBM PowerVC versions 1.2.1.x through 1.2.1.2 IBM PowerVC versions 1.2.2.x through 1.2.2.2 Description The issue allows remote attackers to read or write to arbitrary database records, and consequent...

FireEye Trojan analysis engine (MAS) 6.4.1 – multiple vulnerabilities-vulnerability warning-the black bar safety net

FireEye Trojan analysis system MAS web login section there are multiple serious vulnerabilities. Multiples Vulnerabilities 3 XSS reflected 1 CSRF 1 NoSQLi Json object 1 PostGreSQL SQLi Exploitable? 1 File and Path Disclosure 1 Source code Info-leak XSS: The Cross-Station 1...

MongoDB Patches Remote Denial-of-Service Vulnerability

MongoDB, a popular NoSQL database used in big data and heavy analytics environments, has patched a serious denial-of-service vulnerability that is remotely exploitable. Companies using the default installation of MongoDB, which does not require authentication to access the database, are urged to...

Phabricator: SSRF vulnerability (access to metadata server on EC2 and OpenStack)

In bug 50537, haquaman reported a SSRF vulnerability in the meme creation section of Phabricator. Ticket T6755 was created and the HackerOne issue was closed as "Won't fix". T6755 states that "attackers can use the machine's ability to access the network, which may allow them to find services and...

Oracle NoSQL 11g 1.1.100 R2 - 'log' Parameter Directory Traversal Vulnerability

Exploit for java platform in category web applications source: http://www.securityfocus.com/bid/50567/info Oracle NoSQL is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain...

MongoDB management tool exposure remote code execution vulnerability-vulnerability warning-the black bar safety net

MongoDB, the IT sector mainstream non-relational database NoSQL platform is one that is based on a table of a relational database of the popular alternatives. Recently, the management for MongoDB is a GUI tool phpMoAdmin is the storm has a very serious security vulnerability, once exploited, this...

phpMoAdmin - MongoDB unauthenticated remote execution 0day authomatic exploit

This is an unauthenticated remote execution 0day exploit coded by sp1nlock phpMoAdmin is a web interface for mongodb databases, is like phpmyadmin but for this nosql bigdata oriented database named MongoDB. Usage Info ./phpmohack.py url cmd ex: ./phpmohack.py http://test.com/path/ 'ls -l' This is...

40,000 UnProtected MongoDB Databases Found on the Internet

Nearly 40,000 organisations running MongoDB, a NoSQL high performance and cross-platform document-oriented database, are found to be unprotected and vulnerable to hackers. Three students from University of Saarland in Germany at the Centre for IT Security – Kai Greshake, Eric Petryka and Jens...

Trying to hack Redis via HTTP requests-vulnerability warning-the black bar safety net

0x01 scenario We assume that there is a SSRF vulnerability or a misconfigured proxy server, so that the attacker via HTTP requests to directly access the Redis service. In the above assumptions of the two cases, ask us for the HTTP request to access at least one line is fully controllable, this...

MongoDB NoSQL Collection Enumeration Via Injection Exploit

This module can exploit NoSQL injections on MongoDB versions less than 2.4 and enumerate the collections available in the data via boolean injections. Usage Info msf use auxiliary/gather/mongodbjsinjectcollectionenum msf auxiliarymongodbjsinjectcollectionenum show actions ...actions... msf...

Nosql-Exploitation-Framework - A FrameWork For NoSQL Scanning and Exploitation Framework

A FrameWork For NoSQL Scanning, Enumeration and Exploitation. NoSQL Databases are schema less databases. They were invented to store data easily and flexibly. NoSQL Databases have gained popularity and its security has always been under the scanner. The NoSQL Exploitation Framework focuses...

MongoDB NoSQL Collection Enumeration Via Injection

This module can exploit NoSQL injections on MongoDB versions less than 2.4 and enumerate the collections available in the data via boolean injections. Module Options msf use auxiliary/gather/mongodb/jsinjectcollectionenum msf undefinedjsinjectcollectionenum show actions ...actions... msf...