All labs › NoSQL Injection

🍩 NoSQL Injection

No quotes to escape. You are injecting operators into a document query instead - $ne, $gt, $regex and friends.

1 labs and targetsfree accountlesson included

How injection actually works — taught by The XSS Rat

What it is

Every injection bug is the same shape: a string you control gets glued into something that an interpreter later parses. SQL, NoSQL, XML, templates and XPath differ only in which interpreter you are talking to and which syntax breaks it.

How I attack it

Probe with the syntax of the language, not with a payload list. A quote, a brace, a bracket - whatever that parser treats as special.
An error is a gift, but no error is not a no. Compare response time, length and behaviour between a true and a false condition.
Once you can influence the query, work out what the interpreter can reach: other tables, the filesystem, the template's object graph, an outbound request.
Template injection and XXE regularly end in command execution or file read, so escalate before you report.

Learn it from The XSS Rat

▶ Watch: SQL injection on YouTube ✍ Read: sql injection on Medium 🎓 Course: XXE Guide

Free reference reading

PortSwigger Academy: SQL injection PortSwigger Academy: SSTI HackTricks: SQL injection PayloadsAllTheThings: SQL injection

The lab 1

Operator injection login

A login that builds the query from your JSON. Make it match a user without knowing the password.

Also here 1

Nothing matches thatClear the filter to see everything again.