NoSQL Injection

The notes I took while doing the NoSQLi Walkthrough on TryHackMe.

https://tryhackme.com/room/nosqlinjectiontutorial

NoSQL Databases like MongoDB are on the rise and the methodology of injection is pretty much the same as SQLi.

MongoDB

MongoDB allows you to store data in a structured organized form and enables the user to fetch subsets of data in an ordered format. It works just like relational DBs with the exception being that the data is stored inside documents instead of tables. These documents have data stored in a very basic dictionary structure with key-value pairs.

Here multiple of such documents with similar function can be stored together in structures known as collections. Collections are like tables in SQL databases.

Finally, multiple of such collections are stored together in databases which comes at the top of the hierarchy in NoSQL format.

To query the database a special language is used which is as follows.

If I want to get a result from an employee record having first name Kavin then I will use the following query

• ['first_name' => 'Kavin']

If I want to use multiple fields

• ['first_name' => 'Kavin', 'last_name' => 'Jindal']

If I want to use operators here then I can do the following

• ['age' => ['$lt' => '40']]

• Here $lt represents the less than operator.

More info on https://www.mongodb.com/docs/manual/