Detecting NoSQL injection

Platform: PortSwigger | Category: NoSQL injection | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, NoSQL injection

Summary

Walkthrough of the PortSwigger Web Security Academy lab Detecting NoSQL injection (NoSQL injection). This lab demonstrates a nosql injection vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — NoSQL injection

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

When we select a category, the URL looks as follows.

https://0afa00c303a959438002801500a90058.web-security-academy.net/filter?category=Pets

The backend MongoDB query might look something like -

 mongodb read-only • copy allowed Copy
this.category == 'fizzy' && this.released == 1

Injecting an single quote (') , makes the application to throw an verbose error, which says that it uses mongodb in the backend.

So we can use operator injection to evaluate the query to true & display all the products(both released & not released). - ' || '1' == '1

The query will now be executed as follows

 mongodb read-only • copy allowed Copy
this.category == 'fizzy' || '1'=='1'  && this.released == 1

Now we can see all the items & the lab is solved.

Key Takeaways / Lessons

• Understanding NoSQL injection detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Detecting NoSQL injection