https://github.com/chihab357/nosql-injections
Demonstration of NoSQL Vulnerabilities
https://github.com/chihab357/nosql-injections
ejs html javascript mongodb mongosh nodejs nosql postman sql
Last synced: 4 months ago
JSON representation
Demonstration of NoSQL Vulnerabilities
- Host: GitHub
- URL: https://github.com/chihab357/nosql-injections
- Owner: Chihab357
- Created: 2024-12-15T17:26:04.000Z (over 1 year ago)
- Default Branch: Demo-App-Branch
- Last Pushed: 2024-12-16T16:11:21.000Z (over 1 year ago)
- Last Synced: 2025-07-24T16:14:33.322Z (12 months ago)
- Topics: ejs, html, javascript, mongodb, mongosh, nodejs, nosql, postman, sql
- Language: EJS
- Homepage:
- Size: 19.5 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# 🛡️ NoSQL Injection Demonstration 🚨
**_Educational Purpose Only_**
---
## 📋 Project Overview
This project demonstrates the **vulnerability of NoSQL databases**, focusing on **MongoDB** when used with a **Node.js application**. It highlights how attackers can bypass authentication using improperly validated inputs.
### 💡 Key Learning Points:
- Exploit **NoSQL Injection** using special MongoDB operators like `$gt` and `$or`.
- Demonstrate how **unsecured queries** can alter logic.
- Showcase **mitigation strategies** to secure your app.
---
## 🚀 Tech Stack
- **Backend:** Node.js
- **Database:** MongoDB
- **Testing Tool:** Postman
---
## ⚙️ How It Works
1. **Setup**: Create a database `demo` with a `users` collection containing `username` and `password` fields.
2. **Attack**: Use Postman to send specially crafted JSON payloads with MongoDB operators like:
```json
{ "username": { "$gt": "" }, "password": { "$gt": "" } }