Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag
All challengesIn progress
Web-29. NoSQL Injection in a MongoDB Login Form
Mission
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input. Investigate whether you can log in as the admin without knowing the actual password.
Not started
Hints
Hint 1Show
MongoDB supports operators such as $ne, $gt, and $regex
Hint 2Show
Check whether you can send the request as JSON
Hint 3Show
Try passing an operator object in place of the password field