Nosqli is a fast and simple CLI tool for detecting and exploiting NoSQL injection vulnerabilities, specifically targeting MongoDB-based web applications.
NoSql Injection CLI tool, for finding vulnerable websites using MongoDB.
Security professionals and penetration testers use nosqli to identify NoSQL injection vulnerabilities in web applications that use MongoDB as their datastore. It automates various injection techniques to quickly assess the security posture of endpoints accepting user input in NoSQL queries.
Ensure the target URL includes all testable parameters for accurate scanning. Use with permission on authorized targets only. Proxy support allows integration with interception tools. Building from source requires a recent Go environment. Future updates may include data extraction features.
Download the latest binary for your OS from the releases page
Place the binary in your system PATH or run it from a local folder
Alternatively, clone the repository: git clone https://github.com/Charlie-belmer/nosqli
Navigate into the cloned directory: cd nosqli
Install dependencies: go get -u -d ./...
Build and install the tool: go install
Run nosqli with -h to verify installation and view helpnosqli
Displays the main help and usage information for the tool
nosqli scan -t http://localhost:4000/user/lookup?username=test
Runs a scan on the specified target URL to detect NoSQL injection vulnerabilities using error-based and boolean-based tests
nosqli scan --help
Shows detailed help information for the scan command
nosqli version
Prints the current version of the nosqli tool