loading
Loading content
loading
Vulnerabilities
MongoDB-focused NoSQL injection scanner and injector.
overview
nosqli sits after parameter discovery. Feed parameterized URLs or captured requests so injection probes hit inputs the app already accepts.
Reach for it when a MongoDB-backed endpoint takes user input and you need confirmation, not a guess. It finds injectable parameters and demonstrates the injection.
Trickest runs nosqli as a managed Vulnerabilities node: --target, --request, or --data in; FILE and FOLDER out. Prefer sqlmap when the store is relational SQL.
use cases
Point nosqli at a parameterized URL to detect injectable inputs and confirm the injection, focusing on MongoDB-backed endpoints.
Load a request saved from Burp or ZAP so the scan reproduces the exact headers and body the application expects before injecting.
Supply default POST data so form and API endpoints get tested for injection, not only query-string parameters.
Route requests through a proxy to watch the injection payloads and responses while validating a finding by hand.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | --target | Target URL, e.g. http://site.com/page?arg=1. |
| request | FILE | --request | Load a request from a file, such as one generated in Burp or ZAP. |
| data | STRING | --data | Default POST data (without any injection strings). |
| https | BOOLEAN | --https | Always send requests as HTTPS (defaults to HTTP with request files). |
| proxy | STRING | --proxy | Proxy requests through this proxy URL. |
| user-agent | STRING | --user-agent | Specify a custom user agent. |
| config | FILE | --config | Config file. |
Showing key inputs. nosqli exposes 7 inputs in total.
example
# scan a parameterized URL for NoSQL injectionnosqli scan --target 'http://example.com/user/lookup?user=guest' --data 'role=user' --proxy http://198.51.100.10:8080Scanning http://example.com/user/lookup?user=guest Testing parameter: userTesting parameter: role Found the following NoSQL injections: Type: Boolean-based blind URL: http://example.com/user/lookup?user[$ne]=guest Param: user 1 injection found on http://example.com/user/lookupguidance
Use nosqli when user-controlled input may reach a NoSQL query, especially MongoDB. Feed parameterized URLs or captured requests from a crawl. Use sqlmap when the backend is a SQL database.
Standard SQL injection tester for relational databases. nosqli covers the NoSQL case sqlmap does not; pick by backend type.
Parameter-focused XSS scanner. nosqli targets NoSQL injection on the same class of parameterized endpoints.
Command-injection scanner. nosqli stays on the NoSQL query layer rather than OS command execution.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
Katana crawls a target for parameterized URLs, then nosqli tests them for NoSQL injection and writes the injectable endpoints as a queryable output.
Facts on this page come from the live Trickest tool library.