webmedium

Mongo 2

spbctf

Task: MongoDB NoSQL injection in PHP 5.5.9 app where arrays are cast to strings. Solution: JSON string concatenation injection with duplicate key override and $where operator bypass.

$ ls tags/ techniques/
phpauthentication_bypassstring_concatenationnosqlmongodbjson_injectionnosql_injection
nosql_injection_ne_operatormongodb_query_operator_injectionjson_string_injectionduplicate_json_key_overridewhere_operator_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]