CCT APP Written - Deck A

Question 1

What DB type is MongoDB

Answer 1

Document Oriented

Question 2

What language are the documents in MongoDB stored

Answer 2

BSON (Binary JSON)

Question 3

What is the reserved primary key is MongoDB

Answer 3

_id

Question 4

What does a JSON NoSQL Injection look like

Answer 4

{“username”: { “$regex”: “.*”} }

Question 5

What is an In-Band NoSQL Injection

Answer 5

When the attacker can use the same channel of communication to exploit a NoSQL Injection and receive the result

Question 6

What is a Blind NoSQL Injection

Answer 6

Where the attacker does not receive the results from the NoSQL Injection but they infer the results based on how the server responds

Question 7

What are the two sub-types of Blind NoSQL Injection

Answer 7

Boolean and Time-Based

Question 8

What is a Boolean based NoSQL Injection

Answer 8

Where the attacker forces the server to evaluate a query and return one result or the other if it is true or false

Question 9

What is a Time-based NoSQL Injection

Answer 9

Where the attacker makes the server wait for a specific amount of time before responding, usually indicating if the query is true or false

Question 10

What is the format we use if the query is using URL encoded or x-www-form-urlencoded

Answer 10

Instead of JSON we use param[$regex]=val

Question 11

What are some of the common NoSQL query operators

Answer 11

ne (not equal). Regex. Gt/Gte/Lt/Lte (Greater/Less than(equal to))

Question 12

What is a simple auth bypass using NoSQL injection

Answer 12

username[$regex]=.&password[$regex]=.

Question 13

Example of an NoSQL injection if we know the username

Answer 13

username=admin@mail.com&password[$ne]=invalid

Question 14

What is the character we can use for $lt and $lte and why

Answer 14

We can use the tilde (~) as it is the largest ASCII character

Question 15

How can we perform Blind Data Extraction using NoSQL

Answer 15

username[$ne]=^.* will be true. username[$ne]=^z.* will be false. username[$ne]=^A.* will be true.

Question 16

What is SSJI

Answer 16

SSJI occurs when a $where query is used on the backend

Question 17

What does SSJI stand for

Answer 17

Server Side JavaScript Injection

Question 18

How can we exploit SSJI in NoSQL injection

Answer 18

Query: $where: ‘this.username === “<username>". We can make the username " || sleep(5000) || ""=="</username>

Question 19

How can we check if the first char of the username is A using SSJI in NoSQL injection

Answer 19

Query: $where: ‘this.username === “<username>". We can make the username " || this.username.match('^A.*') || ""=="</username>

Question 20

How can we prevent NoSQL Injection

Answer 20

Sanitising user inputs. Use a white-list of acceptable values and avoud using JS expressions as much as possible