NoSQL Injection

NoSQL Injection is a security issue that affects NoSQL databases. It’s similar to SQL Injection but targets NoSQL databases like MongoDB, CouchDB, Cassandra, and Redis. Here’s a simplified explanation of how it works and how to prevent it

Table of Contents

What is NoSQL Injection?

NoSQL Injection happens when a hacker manipulates the input fields of a web application to inject malicious data into a NoSQL database query. This can lead to unauthorized access to the database, allowing the hacker to view, modify, or delete data

In this room, you will learn about NoSQL Injection. While SQL-based databases are a popular choice for data storage of web applications, several database options that are not based on SQL also exist. Database solutions such as MongoDB, a NoSQL database solution, have seen a significant rise in popularity in recent years.

However, the fundamental principle of injection attacks remains the same. If we have the ability to inject into the database query itself, we have the opportunity to manipulate it!

Answers for this room:

Task 1:

1)I am ready to learn about NoSQL Injection attacks!

Ans: No answer needed

Task 2:

2)What is a group of documents in MongoDB is known as?

Ans: collection

3)Using the MongoDB Operator Reference, what operator is used to filter data when a field isn’t equal to a given value?

Ans: $ne

4)Following the example of the 3 documents given before, how many documents would be returned by the following filter: [‘gender’ => [‘$ne’ => ‘female’] , ‘age’ => [‘$gt’=>’65′] ]?

Ans: 0

Task 3:

5)What type of NoSQL Injection is similar to normal SQL Injection?

Ans: Syntax

6)What type of NoSQL Injection allows you to modify the behaviour of the query, even if you can’t escape the syntax?

Ans: Operator

Task 4:

7)When bypassing the login screen using the $ne operator, what is the email of the user that you are logged in as?

Ans: admin@nosql.int

Task 5:

8)How many users are there in total?

Ans: 4

9)There is a user that starts with the letter “p”. What is his username?

Ans: pedro

Task 6:

10)What is john’s password?

Ans: 10584312

11) One of the users seems to be reusing his password for many services. Find which one and connect through SSH to retrieve the final flag!

Ans: flag{N0Sql_n01iF3!}

Task 7:

12) What common character is used to test for injection in both SQL and NoSQL solutions?

Ans: ‘

13) What is the email value of the super secret user returned in the last entry?

Ans: Syntax@Injection.FTW

Task 8:

14) I understand NoSQL Injection attacks and acknowledge that user data should never be directly accepted into queries!