Name NoSQL Basics
URL https://attackdefense.com/challengedetails?cid=1803
Type Webapp Pentesting Basics
Important Note: This document illustrates all the important steps required to complete this lab.
This is by no means a comprehensive step-by-step solution for this exercise. This is only
provided as a reference to various commands needed to complete this exercise and for your
further research on this topic. Also, note that the IP addresses and domain names might be
different in your lab.
In this exercise, we will take a look at basic SQL queries this includes usage of SELECT
Identifying IP address of the target machine
Command: ip addr
The IP address of the attacker machine is 192.46.210.2. The target machine is located at the IP
address 192.46.210.3
Step 1: Connecting to MongoDB server.
Command: mongo 192.46.210.3
Task 1: Listing Databases
Query: show dbs;
There are 4 databases on the MongoDB server: admin, city, config and local. There is one user
database "city". The databases "admin","config" and "local" are used by MongoDB itself.
Task 2: Selecting a database.
Query: use city.
Task 3: Listing collection stored on the "city" database.
Query: show collections
Task 4: Identifying the number of documents in the database.
Query Syntax: db.<collection-name>.find().count()
Query: db.city.find().count()
There are 29353 document in the collection.
Task 5: List the documents in the city collection.
Query: db.city.find()
Only 20 documents of the collections are listed.
Task 6: The next 20 documents can be viewed by using "it".
Query: it
Task 7: Searching for documents with specific property. Identifying the cities which belong to
the state "MA".
Query: db.city.find({"state":"MA"}).count()
There were 474 cities in the database.
Task 8: Using Greater than operation on a property. Identifying the number of cities which have
populations greater than 15000.
Query: db.city.find({"pop":{$gt:15000}}).count()
Task 9: Using multiple conditions with AND operator. Identify the number of cities which
population is greater than 15000 in the state of Indiana.
Query: db.city.find({$and:[{pop:{$gt:15000}},{"state":"IN"}]}).count()
Task 10: Using multiple conditions with OR operator. Identify the number of cities which have
population less than 100 or are in the state of Indiana.
Query: db.city.find({$or:[{pop:{$lt:100}},{"state":"IN"}]}).count()
Task 11: Using regex to filter documents. Identify the number of cities which start with "AN".
Query: db.city.find({"city":{$regex:"^AN.*"}}).count()
Task 12: Using aggregation methods. Calculate the average population.
Query: db.city.aggregate({"$group":{"_id":null,avg:{$avg:"$pop"}}})
References:
1. MongoDB (https://www.mongodb.com/)
2. mongo (https://docs.mongodb.com/manual/mongo/)