12.3 Lab: Exploiting NoSQL injection to extract data | 2024

The user lookup functionality for this lab is powered by a MongoDB NoSQL database. It is vulnerable to NoSQL injection.

To solve the lab, extract the password for the administrator user, then log in to their account.

You can log in to your own account using the following credentials: wiener:peter.

Turn on the Proxy, log in to your account, and send GET /user/lookup?user=wiener to the repeaterChange the Value of the user to administrator’ && this.password.length > 5|| ‘a’==’b and send the request, if the length of the admin pass is greater than 5 it will display the details of the Admin else it will through an error.Increase it by one till you get the error, that is the length of the password.Then, send the same request to the Intruder and change to value of the user to administrator’ && this.password[0]==’a , now select this payload and click Ctrl+U to URL encode this payload.Choose Cluster Bomb, Add 0 as a payload and a as a payload.Choose the number list as payload1 and set the length of the password, In my case 0 to 7 — a total of 8 characters step by 1.Then Choose, payload2, and choose brute forcer, set the min and max value to 1 to brute force a single character.Now, click start attack, Notice the length and response of the request.With the help of payload1 as sort the response with length and note down the characters.Use that password to log in to the Admin Account to solve the Lab