Burp Suite Enterprise Edition is now available in our secure Cloud  –  Learn more
Research Academy
My account Customers About Blog Careers Legal Contact Resellers
Back to all learning paths
PRACTITIONER

NoSQL injection

This learning path covers the detection, exploitation, and prevention of NoSQL injection vulnerabilities. You'll explore the differences between NoSQL and SQL injection, learn how to perform NoSQL syntax injection, and how to use NoSQL operators to manipulate queries.

Contents

Get started: Types of NoSQL injection

0 of 24

GET STARTED

Types of NoSQL injection 0 of 1

Types of NoSQL injection Get started

NoSQL syntax injection 0 of 7

NoSQL syntax injection

Detecting syntax injection in MongoDB

Determining which characters are processed

Confirming conditional behavior

Overriding existing conditions

Overriding existing conditions - Continued

Lab: Detecting NoSQL injection APPRENTICE

NoSQL operator injection 0 of 4

NoSQL operator injection

Submitting query operators

Detecting operator injection in MongoDB

Lab: Exploiting NoSQL operator injection to bypass authentication APPRENTICE

Exploiting syntax injection to extract data 0 of 5

Exploiting syntax injection to extract data

Exfiltrating data in MongoDB

Identifying field names

Identifying field names - Continued

Lab: Exploiting NoSQL injection to extract data PRACTITIONER

Exploiting NoSQL operator injection to extract data 0 of 5

Exploiting NoSQL operator injection to extract data

Injecting operators in MongoDB

Extracting field names

Exfiltrating data using operators

Lab: Exploiting NoSQL operator injection to extract unknown fields PRACTITIONER

Timing based injection 0 of 1

Timing based injection

Preventing NoSQL injection 0 of 1

Preventing NoSQL injection