skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-nosqli

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and Redis applications.

1.1k|191|Updated Jun 24, 2026
Search Tags:#redis#penetration testing#mongodb#red teaming#nosql injection#couchdb#auth bypass
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-nosqli-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-nosqli
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-nosqli
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-nosqli-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the critical gap of identifying and exploiting NoSQL injection vulnerabilities in applications using NoSQL databases, which are often overlooked by traditional SQL injection testing and can lead to unpatched authentication bypass, full data leaks, and remote code execution risks.

Core Features & Use Cases

  • Multi-Database Coverage: Supports testing for MongoDB operator injection including $where, $regex, $gt, and $ne operators, CouchDB misconfigurations, Redis command injection, and Elasticsearch script injection.
  • Auth Bypass & Data Exfiltration: Includes proven payloads for bypassing login controls without valid credentials and performing blind or direct data dumps of user collections.
  • Use Case: When testing a Node.js + Express e-commerce application that uses MongoDB for user authentication, use this Skill to test the login endpoint for operator injection bypasses to gain admin access, or enumerate user credentials via regex-based blind injection.

Quick Start

Use the hunt-nosqli skill to test the login endpoint of the target MongoDB-backed application for NoSQL injection authentication bypass vulnerabilities.

Frequently Asked Questions about hunt-nosqli

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for NoSQL injection vulnerabilities in a MongoDB application?▼

To test for NoSQL injection in MongoDB applications, you target authentication endpoints and search APIs using operator injection payloads like $where, $regex, $gt, and $ne to bypass controls and exfiltrate data.

What is NoSQL injection authentication bypass and how does it work?▼

NoSQL injection authentication bypass manipulates database query operators such as $ne or $gt in login endpoints, forcing the application to return true for invalid credentials and granting unauthorized access without valid input.

Can I chain NoSQL injection to remote code execution on Redis or MongoDB?▼

Yes, you can chain NoSQL injection to remote code execution by exploiting MongoDB $where JavaScript injection or Redis command injection, escalating from data exposure to full system compromise.

Does NoSQL injection testing work for CouchDB and Elasticsearch?▼

Yes, NoSQL injection testing applies to CouchDB misconfigurations and Elasticsearch script injection, expanding detection beyond traditional SQL injection to cover multiple database platforms.

What is the best way to perform blind data exfiltration using NoSQL injection?▼

The best way to perform blind NoSQL injection data exfiltration is using regex-based payloads against user collections, allowing you to enumerate credentials character by character without direct database dumps.

When do I need to test for NoSQL injection in penetration testing?▼

You need to test for NoSQL injection during penetration testing and red teaming when target applications use NoSQL databases, especially Node.js and Express stacks handling authentication or search APIs.

Related Skills

Explore More Software Engineering Skills→
SkobynSkobyn

hunt-nosqli

Identify and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and Redis.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

nosql-injection

Exploit NoSQL injection vulnerabilities in MongoDB and CouchDB applications.

Official
Advanced
langbyyilangbyyi
96

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs for vulnerabilities.

Community
Intermediate
pdparchitectpdparchitect
13

hunt-sqli

Detect SQL and NoSQL injection vulnerabilities using error-based, boolean-based, and time-based blind techniques.

Community
Advanced