Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [nosql]

A NoSQL (Non SQL) database provides a mechanism for storage and retrieval of data that is modeled in means other than the tabular relations used in traditional relational databases.

Filter by
Sorted by
Tagged with
1 vote
0 answers
96 views

Kusto to Osquery translator?

Osquery is a great open standard for collecting data from endpoints, using SQL syntax. Kusto is a new Microsoft language for collecting data from Windows endpoints, using syntax which is almost--but ...
user502's user avatar
  • 3,311
0 votes
0 answers
226 views

What are the vulnerabilities of using search bar with a NoSQL database for an online app?

I am learning web security I have to audit a searchbar on a test website which looks like site.truc.fr:5006/ for a contest. It seems the query function is hardcoded in the webpage function ...
Revolucion for Monica's user avatar
0 votes
1 answer
654 views

How does this NoSQL injection work? [closed]

Could someone explain what this is doing and how it works? I already know about SQL injection but the NoSQL is confusing. This is a lecture slide from my professor but he provides very little context....
plagiarism's user avatar
2 votes
1 answer
218 views

Is it critical that REST API returns exactly the same content as it is in NoSQL database?

In the past, I've been taught that database schema is crucial and should not be exposed in any way so that users cannot inject the system and steal something from it. However, most of the cases I've ...
user1802604's user avatar
4 votes
1 answer
14k views

How to test for NoSQL injections?

How to test for NoSQL injections? Considering that the structure (or actually the non-structure) of NoSQL databases is very different from structured databases like MySQL, MSSQL or PostgreSQL. Are ...
Bob Ortiz's user avatar
  • 6,665
1 vote
0 answers
284 views

Elastisearch NoSQL injection implications?

I'm testing a web application and have found a parameter that is vulnerable to NoSQL injection (Elastisearch). The parameter is named username and is the only parameter in the HTTP Request. As a ...
pineappleman's user avatar
  • 2,299
3 votes
1 answer
1k views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
Dereksurfs's user avatar
0 votes
2 answers
1k views

Does any SQL/noSQL server accept * (asterisk) as a wildcard character?

I am testing a website and I found an endpoint that accepts an e-mail address and returns a HTTP 200 response if that e-mail is registered, or 401 if that e-mail is not registered. But I also noticed ...
pineappleman's user avatar
  • 2,299
1 vote
0 answers
3k views

Help injecting a MongoDB used by a Python web app

this is a follow up to this thread. So I am trying to perform a NoSQL injection on a web application that is written in Python and connects to a MongoDB backend. The issue I am having is that I am ...
chopteeth's user avatar
14 votes
2 answers
4k views

Is the injection in a NoSQL database architecture also called SQL injection?

Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection? For example, an injection in code that communicates ...
Bob Ortiz's user avatar
  • 6,665
5 votes
0 answers
636 views

MongoDB injection, reading and writing to files

I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go ...
Juicy's user avatar
  • 1,447
11 votes
2 answers
30k views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
Yang Yu's user avatar
  • 439
9 votes
1 answer
2k views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
Cat Nap's user avatar
  • 101
5 votes
2 answers
3k views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
Jon Onstott's user avatar
2 votes
1 answer
1k views

What are Security Practices for NoSql databases [duplicate]

I want to know what are the best practices to secure NoSql database like MongoDB. How is it possible? Any tips?
Ganesh Kunwar's user avatar
3 votes
1 answer
667 views

What are some of the worst DBMS for finical software, and why?

There seems to be an explosion of new databases, especially in the non-relational and "NotOnly SQL" offerings. How does this database fad affect data integrity and security? What are some ways that ...
rook's user avatar
  • 47.2k
5 votes
2 answers
3k views

Security of NoSQL databases

Hopefully this isn't too broad. I've got little experience with NoSQL databases, but I know that they are rising in popularity. As a developer that is extremely concerned with security, I'm ...
David Stratton's user avatar
22 votes
4 answers
28k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
Digital fire's user avatar
  • 3,186
1 vote
1 answer
550 views

Is a multitenant web app built on Apache Cassandra more resilient against DoS attacks?

Imagine a multitenant web app that stores data in a Apache Cassandra cluster, with fairly many nodes. Now assume that: Mallory launches a DoS attack against one tenant. (Perhaps that tenant is a ...
KajMagnus's user avatar
  • 707
28 votes
3 answers
20k views

How to secure a MongoDB instance? [closed]

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
AaronS's user avatar
  • 2,585
12 votes
2 answers
7k views

Encrypting with Mongo

How can I achieve the following goals? All compute and storage to be located in the cloud. Encryption in transit of all data between web nodes and db nodes running MongoDB. How to set up tunnels? ...
yfeldblum's user avatar
  • 2,827