From 4bb3773b1df9f2cbb827361265ee70852fcdc5cf Mon Sep 17 00:00:00 2001 From: za Date: Mon, 11 Nov 2013 13:25:56 +0700 Subject: [PATCH 1/2] Add youtube video: NoSQLMap MongoDB Management Attack Demo --- README.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index aba8eaa..d279094 100644 --- a/README.md +++ b/README.md @@ -60,4 +60,11 @@ Explanation of options: 9. Back to main menu-Use this once the options are set to start your attacks. ``` -Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. The rest of the tool is "wizard" based and fairl self explanatory, but send emails to nosqlmap@gmail.com or find me on Twitter [@tcstoolHax0r](https://twitter.com/tcstoolHax0r) if you have any questions or suggestions. +Once options are set head back to the main menu and select DB access attacks or web app attacks as appropriate. The rest of the tool is "wizard" based and fairl self explanatory, but send emails to nosqlmap@gmail.com or find me on Twitter [@tcstoolHax0r](https://twitter.com/tcstoolHax0r) if you have any questions or suggestions. + +Video +===== + +NoSQLMap MongoDB Management Attack Demo. + +NoSQLMap MongoDB Management Attack Demo From f12d897c69a71b8b9f673e36b0d25652485cdb04 Mon Sep 17 00:00:00 2001 From: za Date: Mon, 11 Nov 2013 14:10:54 +0700 Subject: [PATCH 2/2] Add Ming Chow PDF slide --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d279094..8f78012 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ Introduction NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. -It is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool [sqlmap](http://sqlmap.org), and its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, "Abusing NoSQL Databases". Presently the tool's exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases. +It is named as a tribute to Bernardo Damele and Miroslav's Stampar's popular SQL injection tool [sqlmap](http://sqlmap.org), and its concepts are based on and extensions of Ming Chow's excellent presentation at Defcon 21, ["Abusing NoSQL Databases"](https://www.defcon.org/images/defcon-21/dc-21-presentations/Chow/DEFCON-21-Chow-Abusing-NoSQL-Databases.pdf). Presently the tool's exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases. Requirements ============