nosql-injection
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides an educational Python script template for automating blind extraction which references the
requestslibrary. - [DATA_EXFILTRATION]: Contains instructional content and code examples detailing how to perform blind data extraction from NoSQL databases using regex-based oracles and timing-based logic.
- [REMOTE_CODE_EXECUTION]: Provides documentation on achieving remote code execution on misconfigured targets, specifically through Redis configuration manipulation (writing web shells) and MongoDB's server-side JavaScript operator (
$where). - [COMMAND_EXECUTION]: Includes example commands for interacting with database APIs using tools like
curlandredis-clito demonstrate vulnerability testing.
Audit Metadata