domains / families / security / hunt-nosqli

hunt-nosqli

combined

Hunt NoSQL Injection Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core NoSQLi hunting procedure (auth bypass, URL parameter injection, $where blind injection, data dump, automation, Redis via SSRF, bypass and chain tables). However, the sickn33 copy adds a mandatory authorization/confirmation gate and a distinct Phase 3b for syntax injection into concatenated $where strings, while the uphiago copy adds explicit curl timeouts and a self-test/verification section. Crowning one copy would hide the other's material steps and constraints.