durability) Not using the Open-source relational model Running - - PowerPoint PPT Presentation

▶
durability not using the
SMART_READER_LITE
LIVE PREVIEW

durability) Not using the Open-source relational model Running - - PowerPoint PPT Presentation

Mar 30, 2024 463 likes •1.27k views

Schema less ACID (atomicity, consistency, Support isolation and durability) Not using the Open-source relational model Running well on Built for the 21st clusters century web estates Wide Column Store / Hbase Cassandra Column

slide-1
SLIDE 1
slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5

Schema less “ACID” (atomicity, consistency, isolation and durability) Not using the relational model Built for the 21st century web estates Running well on clusters Open-source Support

slide-6
SLIDE 6

Wide Column Store / Column Families

Hbase Cassandra

Document Store

MongoDB CouchDB

Key Value / Tuple Store

Riak Redis

Graph Databases

Neo4J DEX

slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10

No Proper Validation in API Calls Developers Use them to Develop various Applications PHP is easy to abuse for Mongo ,Couch, Cassandra.

slide-11
SLIDE 11
slide-12
SLIDE 12

Written in: C++ Main point: Retains some friendly properties

  • f SQL. (Query, index)

Protocol: Custom, binary (BSON) Mongod is the "Mongo Daemon” running

  • n Port 27017 by Default

Web Interface Runs on 28017 Mongo is the Client  Mongod Uses MongoDB Wire Protocol (TCP/IP Socket) Data is Represented using JSON format

slide-13
SLIDE 13
slide-14
SLIDE 14

Mongo Client Mongo Client Mongo Server Mongo Client

slide-15
SLIDE 15

Mongo Client Mongo Client Mongo Server Mongo Client Sniffing,Enumeration,JS Injection,DOS

slide-16
SLIDE 16
slide-17
SLIDE 17

JavaScript Attacks mostly used against MongoDB Vulnerabilities Keep Popping Up

  • Run command RCE

Mongo Shell Functions Purely Based on JavaScript Possible Chances to Overwrite Functions Resource Exhaustion Regex Matching ,plenty of JavaScript operations could be used

slide-18
SLIDE 18

Mapping SQL Logical Commands to MongoDB

  • and mapped to &&
  • or to ||
  • ‘=‘ to ‘==‘
slide-19
SLIDE 19
slide-20
SLIDE 20
slide-21
SLIDE 21
slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25
slide-26
SLIDE 26

Blocked

slide-27
SLIDE 27
slide-28
SLIDE 28

PHP converts parameter with brackets to arrays.

  • Already addressed issue in previous researches

Lets Look at Some New vectors

  • $exists
  • $type
  • $all
slide-29
SLIDE 29
slide-30
SLIDE 30

Mongo on 32 bit environment is too easy for attackers (Max Size limit 2GB) Use command creates arbitrary schemas on the fly Attacker could run it continuously exhausting the disk space resource as well as memory. var i=1;while(1){use i=i+1;}

  • An empty database takes up 192Mb
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34

Backend CouchDB

Couch FUTIL Interface Administrator

slide-35
SLIDE 35

Backend CouchDB

Couch FUTIL Interface Administrator

slide-36
SLIDE 36

Written in: Erlang CouchDB document is a JSON object Schema-Free Main point: DB consistency, ease of use Protocol: HTTP/REST Distributed database system Runs on Default Port : 5984,Binds to loopback interface by default Client uses REST API to communicate with the Backend Futon Web Interface

slide-37
SLIDE 37

Admin Party = Game Over. Auth Cookie Sniffable Credentials Send over Unencrypted Channel XSPA attacks in Replication (limited to port web server ports) XSS,HTML Injection in Futon Interface DOS (Versions on 1.5 and below),File Enumeration attacks

slide-38
SLIDE 38

XSS at the token interface HTML injection can be used by attackers to lure the victim to other sites. XSPA Attack can be used in the replication to check whether port is open or not Blind File Name Enumeration possible within the Replication

slide-39
SLIDE 39

Defaults to Expire within 10 min Attacker gaining access would want to use these 10 min Fruitfully NoSQL Framework kicks in with automation session grabbing and dumping necessary info.

slide-40
SLIDE 40

Uses Curl Library to send the requests to the API Un validated PHP APPS could result in calling Arbitrary API Call Execution Download PHP on Couch: https://github.com/dready92/PHP-on-Couch/

slide-41
SLIDE 41
slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49
slide-50
SLIDE 50
slide-51
SLIDE 51
slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55

 Sample Command

ename-command CONFIG l33tshit

 rename-command CONFIG "“

slide-56
SLIDE 56
slide-57
SLIDE 57
slide-58
SLIDE 58
slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61
slide-62
SLIDE 62
slide-63
SLIDE 63
slide-64
SLIDE 64
slide-65
SLIDE 65
slide-66
SLIDE 66
slide-67
SLIDE 67
slide-68
SLIDE 68
slide-69
SLIDE 69
slide-70
SLIDE 70
slide-71
SLIDE 71

A framework of one of its Kind Open Source, Written In Python

  • I am not a hardcode coder(Bugs are prone )

Documented API’s Code Download:nosqlproject.com

slide-72
SLIDE 72
slide-73
SLIDE 73
slide-74
SLIDE 74
slide-75
SLIDE 75
slide-76
SLIDE 76
slide-77
SLIDE 77
slide-78
SLIDE 78
slide-79
SLIDE 79
slide-80
SLIDE 80