NIVA

**NIVA (NoSQL Injection Vulnerable App)** is a simple Web application deliberately designed to have a NoSQL injection vulnerability. The purpose of this project is to help software engineers, security engineers, penetration testers and trainers better understand the principles and dangers of NoSQL injection vulnerabilities. This project makes it convenient for users to practice and learn by providing ** safe and unsafe code examples that are easy to run and check **, and ** concise and easy-to-understand documents **. The current version is based on **MongoDB** as a NoSQL database and uses official Java drivers for data access. Please see the main application interface for username and password. ###Main functions - Users can search their contact lists by email addresses. - If the match is successful, all information about the contact will be returned, including sensitive data such as mobile phone number and address. - The application has two built-in implementations, secure and insecure, making it easy to compare and test NoSQL injection attacks. ###Vulnerability demonstration - The vulnerability is mainly reflected in unsafe code. Developers construct MongoDB queries through string splicing, and attackers can inject them through specially constructed inputs (such as email parameters), thereby bypassing permissions or obtaining more data. - Security rules recommend the use of parameterized queries (such as MongoDB's Filters factory class) to effectively prevent injection attacks. ###Applicable population - software developers - safety Engineer - penetration testers - Cybersecurity trainer