nosql-injection

Send JSON payloads like {"username": "admin", "password": {"$ne": "invalid"}} with Content-Type application/json, or use URL-encoded bracket notation such as password[$ne]=invalid for form endpoints. A successful login with a wrong password confirms operator injection.

Use $regex as a boolean oracle by testing password[$regex]=^a, ^b, and so on, observing login success versus failure per character. Automate with a script that iterates the charset position by position until the full value is recovered.

SQL injection breaks out of string literals in SQL syntax, while NoSQL injection injects query operator objects like $ne, $gt, or $regex that change query logic. Auth bypass uses {"password":{"$ne":""}} instead of ' OR 1=1--.

$where evaluates JavaScript in the MongoDB context but only accesses the current document's fields, so it does not directly give OS command execution. It enables logic abuse and timing-based extraction, though older MongoDB builds without a tight V8 sandbox historically raised RCE concerns.

PHP's $_POST and the Node.js qs library parse bracket notation like password[$ne]=invalid into nested objects, so the value reaches the database driver as an operator object rather than a string. URL-encode the dollar sign as %24 when needed.

For CouchDB, request port 5984 paths like /_all_dbs and /_all_docs?include_docs=true to test unauthenticated access. For Redis on port 6379, try AUTH with common passwords and check whether commands execute without authentication.