nosql-injection

Exploit NoSQL injection vulnerabilities in MongoDB and CouchDB applications.

253|37|Updated Feb 22, 2026

Search Tags:#data extraction #mongodb #rce #authentication bypass #nosql injection #blind injection

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill nosql-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: nosql-injection
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/nosql-injection
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill nosql-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit NoSQL injection vulnerabilities in web applications, enabling authentication bypass and data exfiltration.

Core Features & Use Cases

Vulnerability Detection: Probes common NoSQL injection points in URL parameters and JSON bodies.
Authentication Bypass: Leverages operators like $ne, $gt, and $regex to bypass login mechanisms.
Data Extraction: Extracts data character-by-character using blind techniques when direct output is not available.
Server-Side JS Exploitation: Utilizes $where for command execution and data leakage.
Use Case: A penetration tester suspects a NoSQL injection vulnerability in a login form. They use this Skill to craft payloads that bypass authentication and gain access to the application's backend.

Quick Start

Use the nosql-injection skill to attempt an authentication bypass on the target URL http://example.com/login using a POST request with JSON body.

Frequently Asked Questions about nosql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I bypass authentication using NoSQL injection in MongoDB?▼

Blind NoSQL injection extracts data character-by-character when direct output is unavailable, utilizing `$regex` and `$where` operators to evaluate conditions and infer data based on application response differences.

How does $where operator exploitation work in CouchDB and MongoDB?▼

To extract data using blind NoSQL injection, you evaluate conditions character-by-character using `$regex` and `$where` operators, inferring the data content based on boolean responses from the web application when direct output is hidden.

What NoSQL injection payloads work against JSON body POST requests?▼

Effective NoSQL injection payloads against JSON body POST requests replace string values with objects containing MongoDB operators like `{"$ne": null}` or `{"$gt": ""}` to manipulate query logic, enabling vulnerability detection and authentication bypass.

Can I achieve remote code execution through Mongoose NoSQL injection?▼

You can achieve remote code execution through Mongoose NoSQL injection by leveraging advanced techniques like `$lookup` and server-side JavaScript execution via `$where`, allowing command execution and data leakage beyond simple data exfiltration.