Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

about Exploiting NoSQL operator injection to extract unknown fields

houzichaoisii | Last updated: Aug 31, 2024 12:32PM UTC

"I was working through a NoSQL injection lab on https://portswigger.net/web-security/learning-paths/nosql-injection/exploiting-nosql-operator-injection-to-extract-data/nosql-injection/lab-nosql-injection-extract-unknown-fields and found that the hidden key was 'email' using "$where":"Object.keys(this)[3].match('^.{§§}§§.*')'. However, when I try to run the Intruder with "$where":"Object.email(this)[3].match('^.{§§}§§.*$')', I get an Internal Server Error for all requests. Does this mean there's a bug on the server?"

Ben, PortSwigger Agent | Last updated: Sep 02, 2024 07:29AM UTC

Hi, Are you able to email us at support@portswigger.net and include some screenshots of the steps that you have carried out so that we can see exactly what you have done thus far?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.