nosql-injection

What problem does it solve?

This Skill helps penetration testers identify and exploit NoSQL injection vulnerabilities in web applications, enabling authentication bypass and data exfiltration.

Core Features & Use Cases

• Vulnerability Detection: Probes common NoSQL injection points in URL parameters and JSON bodies.
• Authentication Bypass: Leverages operators like $ne, $gt, and $regex to bypass login mechanisms.
• Data Extraction: Extracts data character-by-character using blind techniques when direct output is not available.
• Server-Side JS Exploitation: Utilizes $where for command execution and data leakage.
• Use Case: A penetration tester suspects a NoSQL injection vulnerability in a login form. They use this Skill to craft payloads that bypass authentication and gain access to the application's backend.

Quick Start

Use the nosql-injection skill to attempt an authentication bypass on the target URL http://example.com/login using a POST request with JSON body.