Collected research
Server-Side JavaScript Injection: Attacking NoSQL and Node.js
Bryan Sullivan's Black Hat USA 2011 whitepaper shows that eval of untrusted input in Node.js servers and MongoDB $where queries executes attacker JavaScript on the server. Payloads run from an eight-byte while(1) denial of service to file read and write via require('fs') and binary execution via child_process.spawn, plus blind extraction of a whole NoSQL database.
Record
- Researcher
- Bryan Sullivan
- Published by
- media.blackhat.com
- Format
- Whitepaper
- Topic
- Injection
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Bryan Sullivan, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .