webmedium

Art is an explosion (Искусство — это взрыв)

duckerz

Task: Web application with MongoDB backend exposing shop API. Solution: NoSQL injection via $where operator in GET /api/shop/{id} endpoint to find hidden record containing base64-encoded flag image.

$ ls tags/ techniques/
jwtbase64nosqlmongodbinjectionwhere_operator
base64_decodenosql_injectionmongodb_where_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]