Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-29. NoSQL Injection in a MongoDB Login Form
Mission
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input. Investigate whether you can log in as the admin without knowing the actual password.
Hints
Hint 1 Show
MongoDB supports operators such as $ne, $gt, and $regex
Hint 2 Show
Check whether you can send the request as JSON
Hint 3 Show
Try passing an operator object in place of the password field