NoSQL injection Basics

Prompts and answers

• Before we can learn about NoSQL injection, let's first take a look at what MongoDB is and how it works.
  *MongoDB*
• A group of documents in MongoDB is known as a...
  collection
• Using the MongoDB Operator Reference, find an operator to filter data when a field isn't equal to a given value
  $ne
• Following the example of the 3 documents given before, how many documents would be returned by the following filter: ['gender' => ['$ne' => 'female'] , 'age' => ['$gt'=>'65'] ]
  0
• **Note:** Make sure to start your machine and navigate to http://MACHINE_IP to start the exercise.
  *How to inject NoSQL*
• When bypassing the login screen using the $ne operator, which user are you logged in as?
  admin
• How many users are there in total?
  3
• There is a user that starts with the letter "p". What is his username?
  pedro
• What is john's password?
  10584312
• One of the users seems to be reusing his password for many services. Find which one and connect through SSH to retrieve the final flag!
  flag{N0Sql_n01iF3!}