skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

nosql-injection

Detect and triage NoSQL injection vulnerabilities in MongoDB, CouchDB, and Elasticsearch applications.

96|1|Updated Jun 4, 2026
Search Tags:#mongodb#api-testing#elasticsearch#security-testing#vulnerability-triage#nosql-injection#graphql-security
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill nosql-injection-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nosql-injection
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/nosql-injection
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill nosql-injection-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

NoSQL injection vulnerabilities in applications using MongoDB, CouchDB, Elasticsearch, or GraphQL-to-NoSQL resolvers can lead to unauthorized data access, authentication bypass, and data manipulation, but unguided testing often risks accidental data loss or service disruption.

Core Features & Use Cases

  • Low-impact triage checks: Uses boolean, type-confusion, and error-differential validation methods that avoid destructive database operations.
  • Injection surface identification: Detects common attack vectors including operator injection ($ne, $gt, $regex, $in, $where), nested object coercion, duplicate keys, and array coercion flaws.
  • Targeted testing scenarios: Optimized for high-risk endpoints including login APIs, password reset flows, search filters, tenant isolation logic, and admin list endpoints.
  • Related skill routing: Automatically directs related vulnerability findings to specialized skills for authorization flaws, business logic issues, and GraphQL-specific weaknesses.

Quick Start

Use the nosql-injection skill to test the user login endpoint's username parameter for MongoDB operator injection using safe boolean comparison checks.

Frequently Asked Questions about nosql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for NoSQL injection vulnerabilities without causing data loss?▼

NoSQL injection testing identifies vulnerabilities in applications processing user-controlled JSON, query parameters, or GraphQL filters for MongoDB, CouchDB, and Elasticsearch. It targets login endpoints, password reset flows, and search functionality to prevent unauthorized data access.

How do I detect MongoDB operator injection on a login API endpoint?▼

Detect MongoDB operator injection on login APIs by applying safe boolean comparison checks and type-confusion tests. This identifies operator injection flaws like $ne, $gt, and $regex without executing destructive database queries.

Does this NoSQL injection testing approach work with Elasticsearch and GraphQL filters?▼

Yes, this NoSQL injection testing approach works with Elasticsearch and GraphQL-to-NoSQL resolvers. It evaluates search DSL inputs and GraphQL filters for nested object coercion and array coercion flaws across multiple database platforms.

What is the best way to triage authentication bypass risks in MongoDB queries?▼

The best way to triage authentication bypass risks in MongoDB queries is through boolean checks and error differential analysis. These low-impact methods identify operator injection and duplicate key flaws in login endpoints safely.

When should I not use boolean checks for NoSQL vulnerability triage?▼

You should avoid using boolean checks for NoSQL vulnerability triage when testing requires deeper validation of nested object coercion or $where operator injection, as these may require routing to specialized GraphQL or authorization flaw skills.

Related Skills

Explore More Software Engineering Skills→
yv1ingyv1ing
612

observer-ward

Fingerprint exposed web applications and services from HTTP, banners, headers, and TLS data.

Community
Intermediate
hffmnnjhffmnnj
39

security-audit

Audit code for security vulnerabilities and generate a structured security report.

Community
Advanced
dungsnowaxedungsnowaxe

nosql-injection-testing

Test NoSQL injection vulnerabilities across MongoDB, Cassandra, CouchDB, Redis, and Elasticsearch.

Community
Advanced
hoanghn61hoanghn61

injection

Probe web endpoints for SQL, NoSQL, OS command, SSTI, XXE, and LDAP injection vulnerabilities.

Community
Advanced