skills.rest
dungsnowaxe
dungsnowaxeCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

nosql-injection-testing

Test NoSQL injection vulnerabilities across MongoDB, Cassandra, CouchDB, Redis, and Elasticsearch.

1|Updated Mar 4, 2026
Search Tags:#security#database#injection#nosql#dast#cwe-943
One-click install
npx skills add https://github.com/dungsnowaxe/prometheus-red-team-bot --skill nosql-injection-testing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nosql-injection-testing
Source: https://github.com/dungsnowaxe/prometheus-red-team-bot/tree/main/promptheus/skills/dast/nosql-injection-testing
Command: npx skills add https://github.com/dungsnowaxe/prometheus-red-team-bot --skill nosql-injection-testing

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical security gap of NoSQL injection vulnerabilities, which can lead to authentication bypass, data exfiltration, and unauthorized code execution in NoSQL databases.

Core Features & Use Cases

  • Comprehensive Database Support: Tests for vulnerabilities across MongoDB, Cassandra, CouchDB, Redis, Elasticsearch, and DynamoDB.
  • Diverse Attack Vectors: Covers operator injection, JavaScript injection, query manipulation, and aggregation pipeline injection.
  • Use Case: When auditing a web application that uses MongoDB for user authentication, this Skill can be used to test if an attacker can bypass login by injecting operators into the username or password fields.

Quick Start

Use the nosql-injection-testing skill to scan the /api/users endpoint for NoSQL injection vulnerabilities.

Frequently Asked Questions about nosql-injection-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for NoSQL injection vulnerabilities in MongoDB and Cassandra?▼

You can test for NoSQL injection by injecting operators into API endpoints or data query logic fields, validating vulnerabilities across MongoDB, Cassandra, CouchDB, Redis, and Elasticsearch to identify CWE-943 risks like authentication bypass and data exfiltration.

What is NoSQL operator injection and how does it bypass authentication?▼

NoSQL operator injection manipulates query operators in database inputs to bypass authentication and exfiltrate data. Testing injects malicious operators into API endpoints to identify vulnerabilities where user-supplied data alters query logic without proper sanitization.

How do I scan API endpoints for NoSQL injection flaws?▼

To scan API endpoints for NoSQL injection flaws, target the data query logic with operator injection, JavaScript injection, and aggregation pipeline injection patterns. This requires knowledge of the target database type and potential injection points within the endpoints.

Does NoSQL injection testing support Elasticsearch and Redis?▼

Yes, NoSQL injection testing supports Elasticsearch and Redis, alongside MongoDB, Cassandra, CouchDB, and DynamoDB. It tests diverse attack vectors including query manipulation and JavaScript injection tailored to each specific database technology.

What do I need to identify CWE-943 risks in NoSQL databases?▼

To identify CWE-943 risks in NoSQL databases, you need knowledge of the target database type and potential injection points within API endpoints. Testing then validates operator injection, JavaScript injection, and query manipulation patterns across the targeted database.

Related Skills

Explore More Software Engineering Skills→
langbyyilangbyyi
96

API Fuzzing for Bug Bounty

Fuzz REST, SOAP, and GraphQL APIs for vulnerabilities.

Community
Intermediate
mahmutkamahmutka
13

Secure Code Review

Trace untrusted input to dangerous sinks across Python, JavaScript, Go, and Java.

Community
Advanced
proffesor-for-testingproffesor-for-testing
436

security-testing

Test software security vulnerabilities using OWASP principles.

Community
Advanced
zebbernzebbern
34

SQL Injection Testing

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced