NoSQL Injection Analysis [Shoppy - HackTheBox]

[@javaboy6581]

Guau increible, te descubri por casualidad. I love your whiteups and reviews!

[@shashiravula8885]

Need more of white box testing please.. This is Great..

[@paolozivic9183]

Awesome, keep it up!👏

[@y.vinitsky6452]

Thanks that was fun

[@0xhech768]

I learned so much thing, nice video. Thanks..

[@BioHack]

I think the search-users route is still injectable passing {"$ne": null} as username. The login instead seems safe but i don't know if there is some trick to make Mongo ignore the passToTest parameter and only use the injectable username (pls some Mongo expert respond this). Anyway nice video, keep it up

[@lilham9044]

how did you know to use that payload as the username?

[@0xdf]

check out the link to the full writeup for that!

[@vishalpatidar893]

👍👍

[@nareshg7292]

wow