hunt-nosqli

Send operator injection payloads in the JSON body, such as {"username": {"$gt": ""}, "password": {"$gt": ""}}, to test whether the server passes objects into the query. Also try URL parameter forms like username[$gt]= for Express-style parsers.

Submit a $where clause containing a time-delay loop, such as a JavaScript function that spins for 5 seconds. If the response consistently takes 5 or more seconds, $where evaluation is enabled and blind injection is confirmed.

The methodology references nosqlmap, installed via pip3, which automates attack and data extraction phases against a target URL. Manual curl payloads remain necessary for confirming specific operators and chains.

Yes, when SSRF is present, internal Redis on port 6379 can be reached via gopher:// URLs to issue commands like FLUSHALL, CONFIG SET, or SLAVEOF. This can escalate to webshell writes or out-of-band data exfiltration if Redis has file system access.

An auth bypass that logs in as an administrator is rated Critical, a full user collection dump is High, and blind injection without useful exfiltration is Medium. Validation requires a valid session token or unauthorized data in the response.