Nosql-MongoDB-injection-username-password-enumeration

NoSQL注入用户名密码枚举脚本 使用此脚本，我们可以枚举存在NoSQL（MongoDB）注入漏洞的Web应用程序的用户名和密码。 漏洞标题：NoSQL注入用户名/密码枚举。 作者：Kalana Sankalpa Anon LK。 网站：https://blogofkalana.wordpress.com/2019/11/14/nosql-injection-username-and-password-enumeration/ 如何运行 用法 root@kitploit: nosqli-user-pass-enum.py -h -u URL -up parameter -pp...

nosqli

NoSQL注入器 一个快速的NoSQL扫描器和注入器。用于发现易受NoSQL注入攻击的网站，特别是MongoDB。 关于Nosqli 我想要一个更好的NoSQL注入工具，它应该易于使用、完全基于命令行并且可配置。为此，我开始开发nosqli——一个用Go编写的简单NoSQL注入工具。 它的目标是快速、准确且高度可用，并拥有易于理解的命令行界面。 特性 Nosqli目前支持Mongodb的NoSQL注入检测。它运行以下测试： 基于错误注入 - 注入各种字符和有效载荷，在响应中搜索已知的Mongo错误 布尔盲注入 - 使用真/假有效载荷注入参数，尝试判断是否存在注入 时间注入 -...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

Agentejo Cockpit <0.12.0 - NoSQL Injection

Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form. id: CVE-2020-35848 info: name: Agentejo Cockpit 0.12.0 - NoSQL Injection author: dwisiswant0 severity: critical...

Cockpit CMS 0.11.1 NoSQL Injection / Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/hashes/identify' class MetasploitModule 'Cockpit CMS NoSQLi to RCE', 'Description' = %q This module exploits two NoSQLi vulnerabilities to...

Cockpit CMS NoSQLi to RCE

This module exploits two NoSQLi vulnerabilities to retrieve the user list, and password reset tokens from the system. Next, the USER is targetted to reset their password. Then a command injection vulnerability is used to execute the payload. While it is possible to upload a payload and execute it...

NoSQLi - NoSql Injection CLI Tool

NoSQL scanner and injector. About Nosqli I wanted a better nosql injection tool that was simple to use, fully command line based, and configurable. To that end, I began work on nosqli - a simple nosql injection tool written in Go. It aims to be fast, accurate, and highly usable, with an easy to...