Nosqli Probe
nosqli_probeDetect NoSQL injection in MongoDB-backed login forms by testing a single body parameter for operator injection and identifying authentication bypass risks.
Instructions
[EXPLOIT — requires human approval] Detect NoSQL injection (MongoDB operator injection) with nosqli.
data supplies one name=value body parameter, and it should be a
valid value (username=alice): the tool mutates what you give it, and a
body rejected before it reaches the query tests nothing.
One pair, not a body, because & is hard-denied for every argument in this
project and nosqli's --data takes a single string. A login form needing
both a username and a password cannot be expressed here — test that by hand,
or with a proxy-driven request. Saying so is the point: the alternative is a
probe that silently tests half the form.
Authentication bypass is the usual impact: {"password": {"$ne": ""}}
matching every document. This probe stops at detection, and enumerating a
collection to show severity is exactly what "do not exfiltrate" means.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| target | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||