Agent skill · security · yaklang
nosql-injection
NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
Why this skill is useful
Provides detailed attack vectors and executable scripts for NoSQL injection that are not commonly known or documented.
What it needs
About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: NoSQL Injection — Expert Attack Playbook AI LOAD INSTRUCTION: NoSQL injection is fundamentally different from SQL injection. Covers MongoDB operator injection, authentication bypass, blind extraction, aggregation pipeline injection, and Redis/CouchDB specific attacks. Very commonly missed by testers who only know SQLi patterns. --- 1. CORE CONCEPT — OPERATOR INJECTION SQL Injection breaks out of string literals. NoSQL Injection injects query operators that change query logic. MongoDB example — normal query: Injection via JSON operator: → Becomes: find({username:"admin", password:{$gt:""}}) → password > "" → always true! --- 2. MONGODB — LOGIN BYPASS JSON Body Injection (API with JSON Content-Type) PHP $POST Array Injection (URL-encoded form) Ruby / Python params Array Injection Same as PHP — use bracket notation to inject objects: %24 = URL-encoded $ --- 3. MONGODB OPERATORS FOR INJECTION Operator Meaning Use Case --- --- --- $ne not equal {"password": {"$ne": "x"}} → always matches $gt greater than {"password": {"$gt": ""}} → all non-empty passwords match $gte greater or equal Similar to $gt $lt less than {"password": {"$lt": "~"}} → all ASCII match $regex regex match {"username": {"$regex": "adm."}} $where JS expression MOST DANGEROUS — code execution $exists field exists {"admin": {"$exists": true}} $in in array {"username": {"$in": ["admin","user"]}} --- 4. BLIND DATA EXTRACTION VIA $REGEX Like binary search in SQLi, use $regex to extract field values character by character: Response difference: successful login vs failed login = boolean oracle. Automate with NoSQLMap or custom script with binary search on character set. --- 5. MONGODB $WHERE INJECTION (JS EXECUTION) $where evaluates JavaScript in MongoDB context. Can only use current document's fields — not system access. But allows logic abuse: Limit: $where doesn't give OS command execution — server-side JS injection (not to be confused with command injection). --- 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/nosql-injection