Skip to content

Latest commit

 

History

History
46 lines (37 loc) · 2.92 KB

README.md

File metadata and controls

46 lines (37 loc) · 2.92 KB
 ███╗   ██╗  ██████╗  ███████╗  ██████╗  ██╗      ██╗      ██████╗ ██╗  ██╗ ███████╗  ██████╗ ██╗  ██╗ ██████╗  
 ████╗  ██║ ██╔═══██╗ ██╔════╝ ██╔═══██╗ ██║      ██║     ██╔════╝ ██║  ██║ ██╔════╝ ██╔════╝ ██║ ██╔╝ ██╔══██╗ 
 ██╔██╗ ██║ ██║   ██║ ███████╗ ██║   ██║ ██║      ██║     ██║      ███████║ █████╗   ██║      █████╔╝  ██████╔╝ 
 ██║╚██╗██║ ██║   ██║ ╚════██║ ██║▄▄ ██║ ██║      ██║     ██║      ██╔══██║ ██╔══╝   ██║      ██╔═██╗  ██╔══██╗ 
 ██║ ╚████║ ╚██████╔╝ ███████║ ╚██████╔╝ ███████╗ ██║     ╚██████╗ ██║  ██║ ███████╗ ╚██████╗ ██║  ██╗ ██║  ██║ 
 ╚═╝  ╚═══╝  ╚═════╝  ╚══════╝  ╚══▀▀═╝  ╚══════╝ ╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚══════╝  ╚═════╝ ╚═╝  ╚═╝ ╚═╝  ╚═╝
The easy way to test NoSQLi in REST APIs

install

npm i -g nosqli-checkr

Test

nosqli-checkr scan --host="https://nosql-checkr-test.herokuapp.com/api/v1/login" --data='{ "user": "wubba", "pass": "" }' --method="post" --params="pass" --error-message='{"success":false,"result":"user/pass not found"}'

Parameters

  • -h or --host: Route URL. Ex: https://nosql-checkr-test.herokuapp.com/api/v1/login
  • -hr or --headers: Request headers. Ex: token:val or token:val;token2:val2
  • -d or --data: Request data: Ex: { "user": "wubba", "pass": "" }
  • -m or --method: Request method: Ex: post or POST
  • -p or --params: Request params which will be exploited: Ex: pass or user,pass
  • -e or --error-message: The default error message of request. Ex: {"success":false,"result":"user/pass not found"}

Result

  • Payload: Is the string used to exploit the request
  • Evil data: The request data with the payload 😈
  • Data stoled: The result from the request

Examples

  • Headers:
nosqli-checkr scan --host="https://api.com/login" --headers='x-api-key:123;authorization:321' --method="POST" --params="id" --data='{"id":"_test-id_"}' --error-message='{"valid":false,"messsage":"error"}'

demo

asciicast