An automated Python tool for auditing and exploiting NoSQL database vulnerabilities and web application injection attacks.
NoSQLMap is an open-source Python tool designed to audit and exploit vulnerabilities in NoSQL databases and web applications. It automates injection attacks and identifies configuration weaknesses to help security professionals assess the security of NoSQL-based systems. The tool supports databases like MongoDB and CouchDB, with plans to extend to Redis and Cassandra.
Security researchers, penetration testers, and ethical hackers who need to assess the security of NoSQL databases and web applications using NoSQL backends.
NoSQLMap provides a dedicated, automated tool for NoSQL security testing, filling a gap left by traditional SQL-focused tools. Its integration with Meterpreter and support for scripting make it versatile for both manual and automated security assessments.
Automated NoSQL database enumeration and web application exploitation tool.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
NoSQLMap automates enumeration of NoSQL instances and injection attacks, reducing manual effort in security assessments, as highlighted in its key features.
It can clone vulnerable MongoDB databases to a local instance for safe offline analysis, a unique feature demonstrated in the usage instructions.
Supports opening Meterpreter shells for post-exploitation, enhancing comprehensive penetration testing, as mentioned in the features list.
Allows scripting attacks via command-line arguments, enabling automation for CI/CD pipelines, as shown in the example scripts.
Requires Python 2.6|2.7, which is no longer maintained, posing security and compatibility issues with modern systems.
Currently only supports MongoDB and CouchDB, with Redis and Cassandra planned but not implemented, reducing utility for other NoSQL systems.
Installation involves multiple dependencies and a local MongoDB instance, which can be cumbersome to configure, as noted in the requirements.