NoSQL Challenges

[J12934]

Hi Guys,
me and a few colleges of mine have wanted to use the JuiceShop to demonstrate NoSQL Injection Attacks. To Do this we have implemented a MongoDB Integration to JuiceShop using a prebuild MongoDB loaded via npm.
The MongoDB is used to store comments for the products. There are 2 challenges regarding NoSQL Injections at the moment.

This was implemented a few Months ago there were some problems with the libraries that should be solved by now.
During OWASP Summit i'd like to update these integration. I dont know if it will be done by the end of it / if it is in a state to get merged by the end of it.

The branch with the current features can be found here:
Feature Branch

I'm always open for feedback on the idea and the features.
Have a good time at the Summit

[bkimminich]

I remember that one... somehow slipped through... It requires a separate DB running, so probably not possible the easy way with single Dockerfile, right? You built in a way where the additional challenges are only available if you find a running NoSQL DB at an expected URL, right?

[J12934]

The MongoDB now runs in the same Container as the the Applications.
The Process get started by the Node Server itself.

The challenge disabling is still in the current implementation, but more a relict of the times where the MongoDB was external. Probably not even really needed when the Database always gets installed with the Application.

[bkimminich]

Oh, this is awesome news! No docker compose needed? 🎉

[J12934]

Yup

[bkimminich]

It'd be great if you could rebase your changes to develop branch. That's easiest to merge them, when it's ready! Let me know if you need any assistance!

[J12934]

Ok i will try that.
And yes i might need some assistance on that, never did any rebasing before 😅

[bkimminich]

Looks there are a few conflicts occuring between your branch and the main repo (no matter if develop or master). It might be easier in the end if you fork freshly and re-apply your changes/enhancements. Sorry for that, but merging might probably be even less fun.

[J12934]

Ok no problem I will do so.
I haven't had any time to work on it during the week, i gonna look into updating the code during the weekend

[lock]

This thread has been automatically locked because it has not had recent activity after it was closed. 🔒 Please open a new issue for regressions or related bugs.