Top Tweets for #NoSQLi
Alhamdulillah 🥹
just got my first 5-digit $$$$$ bounty from my favorite program for a NoSQLi finding that leaks 5+ years of extensive PII.
#BugBounty #NoSQLi #sqli #nosqli #Infosec
I studied NoSQL Injection using resources such as The Web Hacking Arsenal and specialized blogs.
I practiced what I learned and organized my notes on Notion, focusing on understanding the vulnerability not just memorizing payloads.
https://t.co/1WoruEY8he
#NoSQLi #WebSecurity
🧠 NoSQL Injection → Login Bypass
1️⃣ App uses MongoDB:
db.users.find({user: input.user, pass: input.pass})
2️⃣ Attacker sends:
{ "user": { "$ne": null }, "pass": { "$ne": null } }
3️⃣ Query always true → login bypass
🎯 Auth without creds
#bugbounty #nosqli #security
En que consiste el ataque de inyección noSQL donde se puede comprometer la seguridad de una base de datos mongodb si el backend no está bien securizado. #mongodb #nosqli #hackingetico #ciberseguridad #kalilinux #pentesting #basededatos #inyeccionnosql #kalilinux
Here is my new blog post:
MongoDB NoSQL Injection with Aggregation Pipelines
https://t.co/krLppii7Pc
Hopefully this will be useful to someone.
#Appsec #NoSQLi #BugBounty
آسیب پذیری ۱:
اگه ایمیل یه نفر که 2fa نداره رو بدونیم، تابع getPasswordPolicy که بدون نیاز به auth اجرا میشه رو میتونیم #NoSQLi بزنیم!
چون ورودی params به هیچ مدل در این تابع یا قبل رسیدن بهش، sanitize یا چک نمیشه!
چطوری؟ 👇🏻
GraphQLmap - A Scripting Engine To Interact With A Graphql Endpoint For Pentesting Purposes https://t.co/wM1bUPBuTd #GraphQL #GraphQLInjection #GraphQLmap #NoSQLInjection #NoSQLi #Scripting
NoSQLi - A Fast NoSQL Injection Scanner
https://t.co/ofuceOwpkb
#InfoSec #CyberSecurity #NoSQL #NoSQLi #Tools
Hi twitterz, I just released a funny Burp Suite extension, focused on NoSQL injection vulnerability detection.
A missing piece of @Burp_Suite until today.
https://t.co/atvDQC1vyT
#burpsuite #nosqli
NoSQLi - NoSql Injection CLI Tool #CLI #commandline #Exploiting #git #injection #Mongo #Node #nodeJS #NoSQL #NoSQLi https://t.co/SY2GQ88TsK
https://t.co/mH9fFH0fJq - NoSQLi - NoSql Injection CLI Tool https://t.co/ANYobBhfQw #CommandLine #Exploiting #Git #Injection #Mongo #Node #NodeJS #NoSQL #NoSQLi #earmas
NoSQLi - NoSql Injection CLI Tool https://t.co/aoMpEngZUi #CommandLine #Exploiting #Git #Injection #Mongo #Node #NodeJS #NoSQL #NoSQLi
"RT NoSQLi - NoSql Injection CLI Tool https://t.co/8gothk7M8R #CommandLine #Exploiting #Git #Injection #Mongo #Node #NodeJS #NoSQL #NoSQLi"
NoSQLi - NoSql Injection CLI Tool https://t.co/273JlwMQNB #CommandLine #Exploiting #Git #Injection #Mongo #Node #NodeJS #NoSQL #NoSQLi
Interesting 11th hour #nosqli find with an app based on MongoDB where I had control of the 'pipeline' used in an 'aggregation' op. Injecting a 'lookup' stage allows you to pull out data from other Collections, and an "out" stage could be used for an overwrite DoS (untested!).
Last Seen Hashtags on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
241.2M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers