Dumping Data with NoSQL Injection via Regex and Python

Name: Dumping Data with NoSQL Injection via Regex and Python
Uploaded: 2023-07-09T15:01:16Z
Channel: IppSec
Description: Check out Snyk here: https://snyk.co/ippsec 00:00 - Introduction talking about the application we are testing and identifying NoSQL Injection with $ne 0...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

Check out Snyk here: https://snyk.co/ippsec 00:00 - Introduction talking about the application we are testing and identifying NoSQL Injection with $ne 02:30 - Showing the RegEx Operator, which will let us do partial matches and enable us to validate characters one at a time 03:32 - Start of sponsored shoutout to snyk 04:15 - Showing Snyk find some vulnerabilities with Open Source Security 04:40 - Showing Snyk's Code Security 05:54 - Showing and talking about how to patch the vulnerability 07:37 - End of Snyk Shoutout, starting our python script to perform this NoSQL Injection 10:20 - Testing …

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction talking about the application we are testing and identifying NoSQ

2:30 Showing the RegEx Operator, which will let us do partial matches and enable us

3:32 Start of sponsored shoutout to snyk

4:15 Showing Snyk find some vulnerabilities with Open Source Security

4:40 Showing Snyk's Code Security

5:54 Showing and talking about how to patch the vulnerability

7:37 End of Snyk Shoutout, starting our python script to perform this NoSQL Injecti

10:20 Testing out our test_login logic to identify if we had a successful login or n

11:05 Showing how we can identify the length of the string we want

13:20 Creating a loop to automatically identify the length of the string

15:20 Adding exception handling to the function and talking about the benefits

17:40 Creating a function to get the username

20:30 Explaining what our Get_Username function currently does

22:25 Doing a benchmark on our first iteration of the script and seeing it takes sli

24:10 Adding in a break so it doesn't loop over the full character set every time wh

26:00 Talking about the major optimization trick we are going to do, validating mult

27:20 Breaking the enumerating a single character into its own function for exceptio

29:20 Start of coding the optimization trick

35:06 Running our code and seeing we got it down to 12 seconds. Moving on to testing

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →