Lab: Exploiting NoSQL operator injection to extract unknown fields
Summary: PortSwigger's lab targets a MongoDB-backed user lookup vulnerable to NoSQL injection, where changing the login password parameter to {"$ne":"invalid"} returns an "Account locked" error instead of "Invalid username or password," confirming the operator was accepted. The walkthrough then uses JavaScript injection through the $where parameter to enumerate the user object's fields via Object.keys(this)[index].match(), identify a password reset token field, and extract its value character by character with a regex match attack in Burp Intruder.
What's compelling: A single accepted operator turned a login form into a field-enumeration and token-extraction channel, letting an attacker walk the user object and pull Carlos's password reset token without ever knowing a password.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026