Скачать или смотреть Exploiting NoSQL Operator Injection to Bypass Authentication

👩‍🎓👨‍🎓 Learn about NoSQL injection attacks! The login functionality for this lab is powered by a MongoDB NoSQL database. It is vulnerable to NoSQL injection using MongoDB operators. To solve the lab, we'll exploit the vulnerability and log into the application as the administrator user (authentication bypass).

If you're struggling with the concepts covered in this lab, please review https://portswigger.net/web-security/... 🧠

🔗 ‪@PortSwiggerTV‬ challenge: https://portswigger.net/web-security/...

🧑💻 Sign up and start hacking right now - https://go.intigriti.com/register

👾 Join our Discord - https://go.intigriti.com/discord

🎙️ This show is hosted by   / _cryptocat   ( ‪@_CryptoCat‬ ) &   / intigriti  

👕 Do you want some Intigriti Swag? Check out https://swag.intigriti.com

Overview:
0:00 Intro
0:11 Missing background info from previous lab
1:12 NoSQL operator injection
2:01 Submitting query operators
2:53 Detecting operator injection in MongoDB
4:01 Lab: Exploiting NoSQL operator injection to bypass authentication
4:20 Explore site login functionality
5:01 Attempting operator injection
6:59 Conclusion