Hot answers tagged

15 votes
Accepted

MongoDB Nosql injection in python code

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much ...
  • 48.9k
12 votes
Accepted

Is it so easy to hack mongodb database?

While this is true, that is true for many applications. If the attacker already has access to the file system it is far too late to worry about your database server. In unix-type operating systems, ...
  • 402
9 votes
Accepted

Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?

According to Mongo's documentation, the following is used to construct an ObjectId: ObjectId is a 12-byte BSON type, constructed using: a 4-byte value representing the seconds since the Unix ...
  • 8,155
8 votes

MongoDB Nosql injection in python code

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, ...
  • 29k
5 votes
Accepted

How MiTM attack got performed on self-signed certificate while private keys is generated by ourselves?

TL;DR: Using self-signed certificates does not mean MITM is possible and using a certificate issued by a public CA does not mean MITM is impossible. But, it is more likely that MITM is possible if ...
5 votes

Security risks of using MongoDB ID vs a counter in URL?

I can't think of any real security risk to exposing the mongoDB id (versus some other counter id), other than exposing creation time according to the server to the users. Having the mongo primary key ...
  • 38.8k
4 votes

How secure is MongoDB wire protocol?

Mongo database connections will be able to use SSL at some point in the future, but that isn't available yet. Writing to have a more recent reference for this one. From https://docs.mongodb.org/...
  • 141
4 votes
Accepted

Storing UK bank account and sort code in MongoDB database

HTTPS is mandatory of course. But there are a lot more of security options. I can provide you some basics: Server technologies You should implement HSTS (Http Strict Transport Security) to force ...
4 votes
Accepted

Suspicious app name in Windows 10 permission prompt

This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in "%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can ...
  • 178
3 votes
Accepted

Does choice of DBMS matter for protection against XSS and other injection attacks?

protection against XSS attacks ... XSS is an attack against the client side, not the server side where the DBMS resides. Thus the choice of DBMS does not matter here. ... and other similar attacks ...
3 votes

Handling User Permissions Between Front-end and Back-end

I am less used to angular frontends, but this as always been a question: should the control of user permissions be done client-side or server-side? The answer was (and IMHO still is) that client side ...
3 votes
Accepted

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

I recommend to have a bastion host to access your server via a SSH-port forwarding agent to tighten the SSH aspects. Usually I perform OS hardening images using CIS Benchmark guide. Always focus on ...
  • 144
3 votes

Security risks of using MongoDB ID vs a counter in URL?

The OWASP mentions that simply having any sort of direct identifier can be bad, as explained in the Top 10 2007-Insecure Direct Object Reference and Top 10 2010-A4-Insecure Direct Object References ...
  • 5,724
3 votes
Accepted

Proving that a MongoDB is misconfigured and publicly accessible

If it is publicly facing and unauthenticated it is as easy as using a MongoDB administrative client, plugging in the server details, and connecting. Depending on the client's response would prove it ...
  • 3,340
3 votes

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

Exposing a port through Docker bypasses ufw because Docker directly creates an iptables rule. So your firewall is useless. You do not actually need to expose the container port to the host, however, ...
  • 131
2 votes

What type of attacks can be used vs MongoDB?

The tool NoSQLMap includes a lot of functionality that directly targets MongoDB. https://github.com/tcstool/NoSQLMap There is an even-better video available that shows all sorts of attacks. You ...
  • 18.9k
2 votes

Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?

MongoDB OID's are predictable. So if you have access restrictions you need to inforce, such as not allowing person A from Group 1 access to similarly classed objects belonging to persons in Group 2, ...
  • 217
2 votes

Central Authentication Server for SSH and Web wanted

I think you should look at OpenSSH Certificates. With certificates you can have one central key (the CA) to give access to multiple servers. There is multiple guides out there on how to do this. ...
  • 429
2 votes

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

As lack of information next time plizz include kernel version, docker version and if the client application connects with root user. Possible exploits that they used: compromised database client the ...
2 votes

mongodb --auth option

1) What are suggestions on preventing this as a security risk? (perhaps owning the mongodb process by a user/group that not even sudo would a allow shutting down? i.e another unknown username/password ...
  • 178
2 votes
Accepted

OpenSSH login to a system account

Unix systems typically have many user accounts for system purposes, used for a particular system service, e.g. to run a particular daemon. The processes that provide that service run as that user, the ...
2 votes

Proving that a MongoDB is misconfigured and publicly accessible

Note that in the case of MongoDB, the lack of authorization at the shell is by design. It is possible to connect unauthenticated to any MongoDB shell. However you are limited to just seeing the ...
  • 103
2 votes

Security risks of using MongoDB ID vs a counter in URL?

Giving away information in the URL An URL might be accessible even to a person that is not supposed to have access to the actual page it leads to. After all URLs can show up in links all over the web ...
  • 64.5k
2 votes

Should I be thinking about security at the database row/document level?

Generally, what you are describing is the responsibility of the application layer and not the database layer. Your application needs to make sure that only mutually accepted friends are added to the ...
  • 64.5k
2 votes

How MiTM attack got performed on self-signed certificate while private keys is generated by ourselves?

A man in the middle attack is possible without knowledge of your private key by terminating the connection with your server and having a second connection with the client. Wether this is actually ...
  • 14.3k
2 votes

Should Google User ID's be hashed when stored in the database

If you hash the google ID you must then rely on the hash function having no collisions, also as you need to use a plain hash like SHA256 not a salted hash like Bcrypt2, because for lookups you need a ...
  • 834
2 votes

Shellcode in MongoDB Python code

Looking at the error, I'm pretty sure you that this is related to one of the OSCP Lab machines. You could get more help if you post these issues on the forum, but here some tips: "shellcode=" is ...
1 vote

Should Google User ID's be hashed when stored in the database

No. The secret is password, not user ID. Hashing any user IDs has no sense. Furthermore, is seems you store hashed Google passwords. It makes no sense. Normal users will not tell you (your ...
  • 8,556
1 vote
Accepted

Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?

If mongodb only binds to 127.0.0.1 as shown for your config then the ufw rule you've accidentally enabled will not cause mongodb to be accessible from outside either. But to make sure that no kind of ...

Only top scored, non community-wiki answers of a minimum length are eligible