Documentation
¶
Index ¶
Constants ¶
View Source
const ( ModuleID = "nosqli-error-based" ModuleName = "NoSQLi Error Based" ModuleShort = "Detects NoSQL injection via error messages and operator injection" )
Variables ¶
View Source
var ( ModuleDesc = `` /* 692-byte string literal not displayed */ ModuleConfirmation = "Confirmed when injected NoSQL operators trigger database error patterns in the response body" // Error-string matching is inherently heuristic — a driver-error pattern can // surface in non-exploitable contexts (a reflected message, an upstream // component's log line, an incidental token in a bundle) even after the // static-asset, corroboration, reproduce, and clean-control gates. Report // High/Tentative so the finding is treated as a lead to verify, not a // definitive injection. ModuleSeverity = severity.High ModuleConfidence = severity.Tentative ModuleTags = []string{"injection", "sqli", "moderate"} )
Functions ¶
This section is empty.
Types ¶
type Module ¶
type Module struct {
modkit.BaseActiveModule
// contains filtered or unexported fields
}
Module implements the NoSQLi Error Based active scanner.
func (*Module) CanProcess ¶
func (m *Module) CanProcess(ctx *httpmsg.HttpRequestResponse) bool
CanProcess extends the default to skip static assets / code bundles, which are never a NoSQL query handler — a DB-error-shaped token (a driver class name, a lone "$expr") found inside one is incidental, not a leaked database error. The motivating false positive was a MongoDB pattern matched inside a minified pdf.js worker served as application/javascript. Both the captured content-type and the URL path are checked so an asset whose baseline lacked a content-type is still skipped by extension.
func (*Module) ScanPerInsertionPoint ¶
func (m *Module) ScanPerInsertionPoint( ctx *httpmsg.HttpRequestResponse, ip httpmsg.InsertionPoint, httpClient *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
ScanPerInsertionPoint tests a single insertion point for NoSQL injection.
Source Files
Click to show internal directories.
Click to hide internal directories.