> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-nosqli-labs/lab-3.md).

# lab-3

## Exploiting NoSQL Injection to Extract Data

**Difficulty:** Practitioner

### Lab Description

The user lookup functionality for this lab is powered by a MongoDB NoSQL database and is vulnerable to NoSQL injection.

**Objective:** Extract the password for the administrator user, then log in to their account.

**Credentials:** `wiener:peter`

### Solution

**Step 1 — Find the vulnerable endpoint**

Log in as `wiener` and capture all requests in Burp. The category filter and login endpoints don't show obvious injection points, but there is a third request:

```
GET /user/lookup?user=wiener
```

Send it to Repeater and confirm it returns user details for the given username.

**Step 2 — Confirm the vulnerability**

Append a single quote to the username:

```
GET /user/lookup?user=wiener'
```

The response returns:

json

```json
{"message": "There was an error getting user details"}
```

This error indicates the quote broke the backend query, which likely looks something like:

javascript

```javascript
{"$where": "this.user == 'wiener'"}
```

Injecting `wiener'` causes a syntax error — confirming the injection point.

**Step 3 — Establish a baseline true/false condition**

The `$where` operator in MongoDB executes JavaScript, making it possible to test conditions against field values. To verify this, change the user to `administrator` and append a condition that is always true:

```
GET /user/lookup?user=administrator' && this.password.length < 30 || 'a'=='b
```

The backend query evaluates as:

* `user == administrator` → true
* `this.password.length < 30` → true (if the password is short)
* `'a'=='b'` → always false

If the response returns valid user details, the compound condition is `true`, confirming JavaScript execution and that the password is under 30 characters.

**Step 4 — Determine the password length**

By narrowing the length value iteratively, the exact password length can be pinpointed. Sending the request with `< 9` returning success and `< 8` returning no details confirms the password is **8 characters** long.

**Step 5 — Identify the character set**

Use a regex to check whether the password consists only of lowercase letters:

```
GET /user/lookup?user=administrator' && this.password.match(/^[a-z]+$/) || 'a'=='b
```

If user details are returned, the password contains only lowercase letters. Other patterns to test include `\d` for digits, `[A-Z]` for uppercase, and `[0-9]` for numeric ranges.

**Step 6 — Extract the password character by character using Intruder**

With the character set and length known, enumerate each character position with this payload:

```
GET /user/lookup?user=administrator' && this.password[§0§]=='§a§' || 'a'=='b
```

Set up a **Cluster Bomb** attack in Burp Intruder:

* **Payload set 1:** Numbers `0` through `7` (the 8 character positions)
* **Payload set 2:** Letters `a` through `z`

Run the attack and sort the results by response length — the longer (successful) responses reveal the correct character for each position. Assembling the results gives the full administrator password.

**Step 7 — Log in**

Use the extracted password to log in to the administrator account.

### Conclusion

MongoDB's `$where` operator allows arbitrary JavaScript evaluation, which can be exploited to extract data one bit at a time via boolean-based blind injection — even when the application doesn't directly reflect query output.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-nosqli-labs/lab-3.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.