NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
Detected risks:
A technical playbook for identifying and exploiting NoSQL injection vulnerabilities, aimed at penetration testers and security reviewers who need to go beyond classic SQL injection patterns. It explains the core distinction: where SQL injection breaks out of string literals, NoSQL injection injects query operators that alter query logic. The material centers on MongoDB, covering operator injection through JSON request bodies and bracket-notation form parameters (as parsed by PHP, Ruby, Python, and Node.js frameworks) and authentication bypass using operators such as $ne, $gt, $regex, and $exists. It documents blind data extraction that uses $regex as a character-by-character boolean oracle, much like binary search in SQLi, and includes a Python automation template plus URL-encoded GET variants. Server-side JavaScript execution via $where is described, including timing-based blind extraction with sleep(), along with its limits (no OS command execution). Additional sections address aggregation pipeline injection into $match and $group stages, HTTP parameter pollution and array coercion, duplicate-key WAF bypass, and attacks against other data stores — CouchDB's admin HTTP API and Redis command injection or weak-password authentication. Practical detection payloads, a testing checklist (including checks for exposed CouchDB port 5984 and Redis port 6379), and a comparison table contrasting SQLi and NoSQLi across language, injection vector, extraction method, and fingerprinting round out the guidance. It is useful when assessing endpoints that accept JSON query objects, flexible search filters, MongoDB-style operators, or backend query DSLs, and when a form-based endpoint might be switched to a JSON content type to reach an operator-parsing code path. The content is oriented toward recognizing patterns commonly missed by testers who only know SQL injection.
SQL injection breaks out of string literals, whereas NoSQL injection injects query operators (like $ne or $gt) that change the query's logic; extraction uses a $regex character oracle rather than UNION or error-based methods.
By injecting operators in place of a password value, for example {"password": {"$ne": ""}} or {"$gt": ""}, which evaluate as always-true and match a valid user.
$where evaluates JavaScript in the MongoDB context, allowing logic abuse and timing-based blind extraction via sleep(), but it only accesses the current document's fields and does not provide OS command execution.
The $regex operator is used as a boolean oracle, anchoring patterns like ^a and ^ab and narrowing each character position based on the difference between successful and failed responses; a Python script and binary-search approach automate it.
Yes — it includes CouchDB's unauthenticated admin HTTP API (port 5984) for listing databases and creating admin accounts, and Redis (port 6379) command injection and weak-password authentication.
Quick Setup:
.claude/skills/Repository
yaklang/hack-skills