Web Application Hacking (Hands-On)
NoSQL Injection — Concept + Live Lab
Bypass MongoDB-style logins by injecting query operators.
Open the interactive lesson & lab →
NoSQL databases like MongoDB take query objects, not SQL strings. When an app drops user input straight into a query object, you can inject operators like $ne, $gt, or $regex to change the query's logic — no quotes or SQL needed.
A login might run:
db.users.findOne({ username: req.body.username,
password: req.body.password })If you can send an object for password instead of a string:
{ "username": "admin", "password": { "$ne": null } }The password check becomes 'password is not equal to null' — true for every user — so you log in as admin without knowing the password.