nosql-injection
Warn
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides specific command sequences for Redis injection designed to achieve file-write capabilities on a target server, specifically using the CONFIG SET dir and CONFIG SET dbfilename commands to drop a web shell.
- [DATA_EXFILTRATION]: Detailed techniques for blind data extraction from databases using $regex character enumeration and time-based oracles via the $where operator are included.
- [DYNAMIC_EXECUTION]: The skill contains a functional Python script template for automating blind NoSQL injection attacks using the requests library.
- [REMOTE_CODE_EXECUTION]: Instructions cover server-side JavaScript execution via the MongoDB $where operator, noting its potential for arbitrary logic abuse and timing-based attacks.
- [INDIRECT_PROMPT_INJECTION]: As an expert attack playbook, the skill provides an extensive capability surface for an agent to perform high-risk injection attacks on external infrastructure without built-in sanitization or boundary markers.
- [PERSISTENCE]: The Redis attack methodology described specifically targets the creation of persistent web shells in the server's web root directory.
Audit Metadata