skills.rest
devtint
devtintCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

nosql-injection

Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and Redis APIs.

Updated Feb 23, 2026
Search Tags:#security#database#api#injection#nosql#mongodb
One-click install
npx skills add https://github.com/devtint/API_PENTEST --skill nosql-injection-devtint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nosql-injection
Source: https://github.com/devtint/API_PENTEST/tree/main/testing/SKILLS/nosql-injection
Command: npx skills add https://github.com/devtint/API_PENTEST --skill nosql-injection-devtint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and exploits injection vulnerabilities in NoSQL database-backed APIs, helping to secure sensitive data.

Core Features & Use Cases

  • Operator Injection: Tests for vulnerabilities like authentication bypass and user enumeration in MongoDB.
  • Data Extraction: Extracts sensitive data using techniques like $where and $regex injection.
  • Database Support: Covers MongoDB, CouchDB, and Redis injection methods.
  • Use Case: When testing an API that accepts JSON input and uses a MongoDB backend, use this skill to check for common injection flaws that could lead to data breaches.

Quick Start

Use the nosql-injection skill to test the login endpoint for MongoDB authentication bypass vulnerabilities.

Frequently Asked Questions about nosql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a MongoDB API for NoSQL injection vulnerabilities?▼

NoSQL injection detection targets APIs accepting JSON input to exploit MongoDB, CouchDB, and Redis backends. It identifies authentication bypass, user enumeration, and data extraction flaws by abusing query operators like $where and $regex.

What is NoSQL operator injection and how does it bypass authentication?▼

NoSQL operator injection manipulates JSON payloads using MongoDB operators like $ne or $gt to force true evaluations. This bypasses authentication by altering query logic, allowing unauthorized access to API endpoints.

Can I extract data from a CouchDB backend using $regex injection?▼

Yes, you can extract data from a CouchDB backend using $regex injection by systematically evaluating true or false API responses. This enumerates and reconstructs sensitive database records character by character.

Does this NoSQL injection testing method work with Redis databases?▼

Yes, this NoSQL injection testing method supports Redis databases alongside MongoDB and CouchDB. It detects injection flaws by manipulating API inputs to exploit backend query handling and extract exposed data.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

injection-checking

Map attacker-controlled input to relevant injection deep-dive skills.

Official
Intermediate
Patasse97Patasse97

database-designer

Design and optimize SQL and NoSQL database schemas, migrations, and query patterns.

Community
Advanced
YukiIto1999YukiIto1999

exploiting-nosql-injection-vulnerabilities

Detect and exploit NoSQL injection vulnerabilities in web applications using MongoDB and CouchDB.

Community
Advanced
pdparchitectpdparchitect
13

hunt-sqli

Detect SQL and NoSQL injection vulnerabilities using error-based, boolean-based, and time-based blind techniques.

Community
Advanced