The need for Pentesting NoSQL Databases gave rise to the NoSQL Exploitation Framework,which has support for Mongo,CouchDB,Redis,H-Base and Cassandra.

1. NoSQL Exploitation
Framework
NULLCON AMMO 2014

2. About Me
 Independent Security Researcher
 Member of OpenSecurity
 Currently Pursuing My B.Tech (Amal Jyothi College of
Engineering)
 Speaker (Spoke @ Defcon Kerala, Defcon Bangalore,DerbyCon
USA)
 Will Be Speaking @ Hack in the Box AMS 2014 on NoSQL
Security and Exploitation Framework where the full fledged
framework will be released 
 Sleeps @ Morning, Researches and Codes @ Night 

3. LongShort
NoSQLStory
 Straight Out of the Box Issues
 Default port Mongo:27017,Couch:5984,Redis:6379
 Default Security=NULL
 A Shodan Search could fetch you 1000’s of Servers Easily,
P.S: I am Not Joking
 Weak Authentication Mechanisms
 Encryption Issues
 Session Hijacking and MiTM Attacks
 AvailableAuthentication Mechanisms Difficult to Deploy

4. Why Is the Framework
Special ?

5. FEATURES
For the FirstTime Ever A Scanning and Enumeration Framework for
NoSQL Databases
 Written in Python
 Scanning Module For Mongo,Couch,Redis
 Enumeration Module for Mining DB data for Mongo, Couch and
Redis
 Sniffs For Sessions and Passwords
 Detection of REST Interfaces
 Shodan Search Feature
 Couch DB Auto Dump Using Session ID
 Dictionary Attack
 Clone and Dump Databases on the Fly.
 Auto Screenshot Feature Available for REST Interface
 Detection for Master-Slave replication in Mongo and acts
accordingly

6. Future
Releases
 Added Support for Web App detection and Exploitation
 Stored Procedure Calls (Post Exploitation Phase)
 Added Support for Neo4J,H-Base,Cassandra
 Shodan Header based Search
 Iron Python GUIVersion in Progress
 Multithreaded and Proxy Support
 Resource Exhaustion by creating Arbitrary Databases
 Fuzzing Module

7. DownloadCode
https://github.com/torque59/Nosql-Exploitation-Framework

8. SCREENSHOTS

9. Scanning

10. Enumerating
SysInfo

11. Enumerating
Databases

12. Dictionary
Attacks

13. Video Demos

14. SniffCouch

15. Sniff and Brute

16. Enumerate
Mongo

17. Redis
Enumeration

18. Reach me @
Email : helofrancis@gmail.com
Twitter:@torque59
Facebook:francis.alexander.33