Pentesting MongoDB for absolute beginners

Set up the lab by installing mongodB on Linux, Mac, or Windows, booting the Oberndorf VM, configuring host-only networking, and starting the server for connections on 27017.

Master basic MongoDB shell commands for databases, collections, and documents, including db, use, show databases, insert, find, delete, and drop. The lecture guides a lab session using ssh and mongosh.

Explore a beginner-friendly MongoDB security assessment focused on open ports like 27017 and misconfigurations. Identify exposed interfaces, weak authentication, and injection risks with nmap and service detection.

Scan for MongoDB ports with nmap to identify running instances on port 27017, and check the http interface on port 28017. Verify service version and exposure with a quick rescan.

Explore how to use nmap with mongodb-brute to test whether a remote MongoDB instance requires authentication, and use mongodb-databases to enumerate available databases.

Exploit unsecured mongodb instances by connecting remotely, listing databases, inspecting collections like users and products, executing JavaScript, and accessing the unauthenticated HTTP console on port 28017.

Learn how to secure a MongoDB instance by enabling authentication, creating users, connecting with credentials, and restricting remote access by binding to localhost or specific IPs.

Explore how a MongoDB-backed web app handles login and product searches, identify and exploit injection vulnerabilities, and learn remediation steps in an introduction to pentesting MongoDB for beginners.

Explore how NoSQL injection works in MongoDB by querying a sample database, testing conditional operators, and recognizing improper handling through error messages like bad value unknown operator.

Demonstrate NoSQL injection exploitation against a MongoDB-backed login, using Burp Suite to proxy requests, craft conditions to bypass authentication, and observe server responses.

Explore continued exploitation of NoSQL injections against MongoDB, bypassing authentication, crafting inputs with operators to reveal user data and product details, and learn defensive practices against such attacks.

Explore how a MongoDB login can suffer NoSQL injection and fix it by enforcing string input types before passing user credentials to the database driver.

Demonstrates how a NoSQL injection attack on a MongoDB-backed app can reveal multiple user details through unsafe input, illustrating practical exploitation for absolute beginners.

Learn to run automated MongoDB assessments using the skill map tool, configure targets, perform anonymous access checks, and test web application attacks and potential SQL injection vulnerabilities.