nosqli was developed as an open source NoSQL scanner written in Go. It’s configurable with command line options, and runs a large number of injection attempts against targets. It’s mostly focused on Mongo injections, but does work to a lesser extent against any database that uses JavaScript.

$ nosqli
NoSQLInjector is a CLI tool for testing Datastores that 
do not depend on SQL as a query language. 

nosqli aims to be a simple automation tool for identifying and exploiting 
NoSQL Injection vectors.

Usage:
  nosqli [command]

Available Commands:
  help        Help about any command
  scan        Scan endpoint for NoSQL Injection vectors
  version     Prints the current version

Flags:
      --config string       config file (default is $HOME/.nosqli.yaml)
  -d, --data string         Specify default post data (should not include any injection strings)
  -h, --help                help for nosqli
  -p, --proxy string        Proxy requests through this proxy URL. Defaults to HTTP_PROXY environment variable.
  -r, --request string      Load in a request from a file, such as a request generated in Burp or ZAP.
  -t, --target string       target url eg. http://site.com/page?arg=1
  -u, --user-agent string   Specify a user agent

Use "nosqli [command] --help" for more information about a command.

$ nosqli scan -t http://localhost:4000/user/lookup?username=test
Running Error based scan...
Running Boolean based scan...
Found Error based NoSQL Injection:
  URL: http://localhost:4000/user/lookup?=&username=test
  param: username
  Injection: username='

Using NoSQLi

nosql scanning using nosqli

It has a simple and flexible CLI interface for scanning. You can pass in a target URL with GET parameters that need to be scanned, or a saved request with POST data. The scanner is smart enough to know if the data is JSON or form data, and will inject either way.

The configurations currently support running through a proxy (so you can view the generated traffic in Burp or similar software) and changing the user agent.

Scanning Types

NoSQLi has the most commonly found injection vectors implemented:

Error Scans: Look for known error strings in responses from the server.
Blind Boolean Injections: When the page doesn’t return errors, but does return different data when true or false is returned from the database (or when some records are retrieved vs. no records)
Timing based injections: When all else fails, if the database sends a delayed response after a successful injection.

Using NoSQLi with Requests

A key feature missing from a few previous scanners was the ability to export a request from a proxy and run the injections based on that. NoSQLi can leverage this easily, and keeps all the header information, including things like user agent.

While the tool does not yet support importing a full session log and executing tests against all requests sequentially, saving a standard HTTP request to a file and referencing that file allows repeatable tests, or extraction from other tools such as Burp.

Installing NoSQLi

The github page has all the instructions. You can build from source or download and run the appropriate executable for your system.

Nfstream – A Flexible Network Data Analysis Framework

Majordomo — Fri, 07 Feb 2020 10:29:59 +0000

nfstream is a Python package providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data processing framework for researchers providing data reproducibility across experiments.

Main Features

Performance: nfstream is designed to be fast (x10 faster with pypy3 support) with a small CPU and memory footprint.
Layer-7 visibility: nfstream deep packet inspection engine is based on nDPI. It allows nfstream to perform reliable encrypted applications identification and metadata extraction (e.g. TLS, QUIC, TOR, HTTP, SSH, DNS).
Flexibility: add a flow feature in 2 lines as an NFPlugin.
Machine Learning oriented: add your trained model as an NFPlugin.

How to use it?

Dealing with a big pcap file and just want to aggregate it as network flows? nfstream make this path easier in few lines:

   from nfstream import NFStreamer
   my_awesome_streamer = NFStreamer(source="facebook.pcap") # or network interface (source="eth0")
   for flow in my_awesome_streamer:
       print(flow)  # print it, append to pandas Dataframe or whatever you want :)!

    NFEntry(
        id=0,
        first_seen=1472393122365,
        last_seen=1472393123665,
        version=4,
        src_port=52066,
        dst_port=443,
        protocol=6,
        vlan_id=0,
        src_ip='192.168.43.18',
        dst_ip='66.220.156.68',
        total_packets=19,
        total_bytes=5745,
        duration=1300,
        src2dst_packets=9,
        src2dst_bytes=1345,
        dst2src_packets=10,
        dst2src_bytes=4400,
        expiration_id=0,
        master_protocol=91,
        app_protocol=119,
        application_name='TLS.Facebook',
        category_name='SocialNetwork',
        client_info='facebook.com',
        server_info='*.facebook.com',
        j3a_client='bfcc1a3891601edb4f137ab7ab25b840',
        j3a_server='2d1eb5817ece335c24904f516ad5da12'
    )

From pcap to Pandas DataFrame?

    import pandas as pd 
    streamer_awesome = NFStreamer(source='devil.pcap')
    data = []
    for flow in streamer_awesome:
       data.append(flow.to_namedtuple())
    my_df = pd.DataFrame(data=data)
    my_df.head(5) # Enjoy!

Didn’t find a specific flow feature? add a plugin to nfstream in few lines:

    from nfstream import NFPlugin

    class my_awesome_plugin(NFPlugin):
        def on_update(self, obs, entry):
            if obs.length >= 666:
                entry.my_awesome_plugin += 1
  
   streamer_awesome = NFStreamer(source='devil.pcap', plugins=[my_awesome_plugin()])
   for flow in streamer_awesome:
      print(flow.my_awesome_plugin) # see your dynamically created metric in generated flows

More example and details are provided on the official documentation.

Prerequisites

    apt-get install libpcap-dev

Installation

Using pip
Binary installers for the latest released version are available:

    pip3 install nfstream

Build from source
If you want to build nfstream on your local machine:

    git clone https://github.com/aouinizied/nfstream.git
    cd nfstream
    python3 setup.py install

Contributing
Please read Contributing for details on our code of conduct, and the process for submitting pull requests to us.

Authors
Zied Aouini created nfstream and these fine people have contributed.

Ethics
nfstream is intended for network data research and forensics. Researchers and network data scientists can use these framework to build reliable datasets, train and evaluate network applied machine learning models. As with any packet monitoring tool, nfstream could potentially be misused. Do not run it on any network of which you are not the owner or the administrator.

Download Nfstream

The post Nfstream – A Flexible Network Data Analysis Framework appeared first on Tech Chronicles.

data analysis Archives - Tech Chronicles

NoSQLi – A Fast NoSQL Injection Scanner

Using NoSQLi

Scanning Types

Using NoSQLi with Requests

Installing NoSQLi

Nfstream – A Flexible Network Data Analysis Framework