NoSQL injection / MongoDB operator injection triage. Use when parameters or JSON bodies may reach MongoDB, CouchDB, Elasticsearch-style query DSL, JSON query filters, $where JavaScript, GraphQL-to-NoSQL resolvers, or when HackSkills routes MongoDB/JSON query syntax exposure to NoSQL Injection.
NoSQL Injection
Core Rule
Use only in authorized testing. Prefer low-impact boolean, type-confusion, and error-differential checks. Do not dump data, brute-force secrets, or run destructive database operations.
First-Pass Triage
Identify whether user-controlled JSON, query parameters, GraphQL filters, search DSL, or form fields are translated into a NoSQL query.
Look for operator injection surfaces: $ne, $gt, $regex, $in, $where, nested objects where a scalar is expected, duplicate keys, and array coercion.
Compare baseline with harmless negative/positive controls:
expected scalar vs object
valid ID vs impossible ID
regex that matches nothing vs exact normal value
Treat login, password reset, search, tenant filters, price/quantity fields, and admin list APIs as high-value candidates.
Confirm with differential evidence: status, result count, stable body markers, error text, or authorization boundary changes.
Route To Related Skills
Use api-authorization-and-bola when the issue is object ownership or tenant filtering.
Use business-logic-vulnerabilities when NoSQL type confusion changes price, quantity, coupon, or workflow state.
Use graphql-and-hidden-parameters when the query surface is GraphQL.
Use burp-mcp-vuln-check for replay and response diffing from Burp history.
