https://blog.redteamshell.com/tags/nosql/Recent content in Nosql on Fabrice's BlogHugoen<a href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank" rel="noopener">CC BY-NC 4.0</a>Fri, 06 Nov 2026 02:30:00 +0100https://blog.redteamshell.com/posts/2026/11/cwee-path-notes-module-2-introduction-to-nosql-injection/Fri, 06 Nov 2026 02:30:00 +0100https://blog.redteamshell.com/posts/2026/11/cwee-path-notes-module-2-introduction-to-nosql-injection/<p><img src="https://blog.redteamshell.com/images/cwee-m02-hero.jpg" alt="CWEE Module 02 Hero"></p> <h2 id="where-nosql-injection-fits--and-the-one-idea-behind-all-of-it">Where NoSQL injection fits — and the one idea behind all of it</h2> <p><img src="https://blog.redteamshell.com/images/cwee-m02-01-one-idea.jpg" alt="One idea, many channels"></p> <p>This is the second module in the Senior Web Penetration Tester path, the track that leads into CWEE. Module one was classic injection; this one is entirely about MongoDB and NoSQL injection, which looks nothing like SQLi on the surface and trips people up for exactly that reason.</p> <p>There is no NoSQL &ldquo;standard&rdquo; the way there is a SQL standard, so there is no single NoSQL injection. What there is, in MongoDB specifically, is one underlying idea that every technique in the module turns out to be a variation on: <strong>the server builds a query from user input, and that input is trusted to be the type the developer assumed it was.</strong> Break that assumption — hand the query an object, or a fragment of JavaScript, where it expected a plain string — and you are controlling query logic instead of supplying a value.</p>