exploiting-nosql-injection-vulnerabilities

name	exploiting-nosql-injection-vulnerabilities
description	Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
domain	cybersecurity
subdomain	web-application-security
tags	["nosql-injection","mongodb","authentication-bypass","injection-attack","web-security","database-security","api-testing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Exploiting NoSQL Injection Vulnerabilities

When to Use

• During web application penetration testing of applications using NoSQL databases
• When testing authentication mechanisms backed by MongoDB or similar databases
• When assessing APIs that accept JSON input for database queries
• During bug bounty hunting on applications with NoSQL backends
• When performing security code review of database query construction

How to CONFIRM a Hit (avoid false negatives)

• The positive signal is a behavioural differential caused by an operator, not a generic error: an operator-injection payload ({"$ne":null} / {"$gt":""}) returns a logged-in session / different record set than a benign value, OR a $where+sleep payload adds a measurable delay, OR a $regex boolean probe flips the response between two known states.
• Confirm auth bypass by diffing three requests: valid creds, invalid creds, and the operator payload. The injection is real only if the operator response matches/exceeds the "valid" response while plain-invalid stays rejected.
• For blind extraction, prove the channel works: anchor a $regex that MUST match (^) and one that MUST NOT, and confirm the two responses differ before extracting characters.
• Do NOT conclude negative until you have tried ALL of these encodings/forms:
  • JSON body operator form: {"user":{"$ne":null}}.
  • URL/bracket form: user[$ne]=x, user[$regex]=^a, user[$exists]=true, user[$in][]=admin.
  • String-wrapped operators where the app does JSON.parse on a field: user=%7B%22%24ne%22%3Anull%7D.
  • $where/$function server-side JS with sleep() for time-based blind.
  • GET vs POST, and Content-Type: application/json vs application/x-www-form-urlencoded (frameworks parse brackets differently).
  • Type juggling: send an array/object where a string is expected (password[]=x).
• A 200 with the same body as a normal failed login is NOT a hit — require an authenticated/differential response. Test both username and password independently.