nosql-injection

SKILL.md

SKILL: NoSQL Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: NoSQL injection is fundamentally different from SQL injection. Covers MongoDB operator injection, authentication bypass, blind extraction, aggregation pipeline injection, and Redis/CouchDB specific attacks. Very commonly missed by testers who only know SQLi patterns.

1. CORE CONCEPT — OPERATOR INJECTION

SQL Injection breaks out of string literals.

NoSQL Injection injects query operators that change query logic.

MongoDB example — normal query:

db.users.find({username: "alice", password: "secret"})