Lab: Exploiting NoSQL injection to extract data
Summary: PortSwigger's lab presents a user lookup function backed by a MongoDB NoSQL database that is vulnerable to NoSQL injection, and the goal is to extract the administrator password and log in as that user. The walkthrough shows that a single quote in the user parameter causes an error, that a JavaScript payload such as wiener'+' returns the wiener account, and that boolean conditions like wiener' && '1'=='2 versus wiener' && '1'=='1' produce different responses, allowing a condition such as administrator' && this.password.length < 30 || 'a'=='b' to test password length before enumerating the password in Intruder.
Key Takeaway: The password here uses only lowercase letters, so once an attacker can ask true-or-false questions through a query parameter, the search space collapses to a short character-by-character enumeration. The same boolean channel that reveals an administrator's password in this lab exists wherever user input reaches a MongoDB query without sanitization.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026