Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

NoSQL injection → auth bypass → admin

Login endpoint passes user-supplied JSON into a MongoDB query. Send {"$ne": null} to bypass the password check.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: Node + Mongo (or PHP + Mongo) login route accepts JSON body and embeds it in find/findOne unsanitised. No bcrypt-then-compare-string pattern.

§ Steps

  1. 01
    Exfil sensitive collectionsExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Authenticate as adminInitial Access
    T1078— Valid Accounts
  3. 03
    Find JSON login endpointReconnaissance
    W-RECON-API-DISCO— API Endpoint Discovery
  4. 04
    Enumerate users via $regex blindCollection
    W-NOSQLI— NoSQL Injection (MongoDB)
  5. 05
    Inject $ne / $gt operatorCollection
    W-NOSQLI— NoSQL Injection (MongoDB)

    {"username":"admin","password":{"$ne":null}}

§ References

§ Frequently asked

What is the "NoSQL injection → auth bypass → admin" attack path?
Login endpoint passes user-supplied JSON into a MongoDB query. Send {"$ne": null} to bypass the password check. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil sensitive collections (T1041) — a exfiltration primitive. Assumed environment: Node + Mongo (or PHP + Mongo) login route accepts JSON body and embeds it in find/findOne unsanitised.
What is the final impact of this kill-chain?
The final step lands on Inject $ne / $gt operator (W-NOSQLI), which falls under Collection. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers