hunt-nosqli

What problem does it solve?

Identify and exploit NoSQL injection vulnerabilities across MongoDB, CouchDB, and Redis by leveraging operator injections such as $where, $regex, $gt, and $ne, enabling authentication bypass and data exfiltration during authorized testing.

Core Features & Use Cases

• Operator injection techniques for MongoDB: $where, $regex, $gt, $ne; NoSQLi payloads to bypass login and enumerate data.
• Redis and CouchDB exposure patterns: command injection via misconfigured endpoints and exposed admin UI; data dumping workflows.
• Real-world scenarios include authenticated bypass in MongoDB-backed apps and data extraction from user collections.

Quick Start

Initiate an authorized NoSQL injection test against a target using MongoDB, CouchDB, or Redis to validate vulnerability presence.