webPromedium

Art is an explosion (Искусство — это взрыв)

duckerz

Task: Web application with MongoDB backend exposing shop API. Solution: NoSQL injection via $where operator in GET /api/shop/{id} endpoint to find hidden record containing base64-encoded flag image.

$ ls tags/ techniques/
jwtbase64nosqlmongodbinjectionwhere_operator
base64_decodenosql_injectionmongodb_where_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups