Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

about Exploiting NoSQL operator injection to extract unknown fields

houzichaoisii | Last updated: Aug 31, 2024 12:32PM UTC

"I was working through a NoSQL injection lab on https://portswigger.net/web-security/learning-paths/nosql-injection/exploiting-nosql-operator-injection-to-extract-data/nosql-injection/lab-nosql-injection-extract-unknown-fields and found that the hidden key was 'email' using "$where":"Object.keys(this)[3].match('^.{§§}§§.*')'. However, when I try to run the Intruder with "$where":"Object.email(this)[3].match('^.{§§}§§.*$')', I get an Internal Server Error for all requests. Does this mean there's a bug on the server?"

Ben, PortSwigger Agent | Last updated: Sep 02, 2024 07:29AM UTC