Name: exploiting-nosql-injection
Author: ThanhHai151

About

Imported from ThanhHai151/Security-Forge-AI (ai_framework/skills/exploiting-nosql-injection/SKILL.md). Install upstream with npx skills add ThanhHai151/Security-Forge-AI --skill exploiting-nosql-injection. Copyright stays with the author (Apache-2.0).

When to Use

JSON, form, filter, search, or authentication input is merged into a document/graph/search query or accepts query operators.

Prerequisites

Identify the exact parameter and keep tests read-only and bounded.
Use synthetic records and paired controls; do not enumerate an entire collection/index.

Reasoning Questions

[surface] Which request values become filters, operators, projections, scripts, selectors, or full query-DSL objects?
[context | if a NoSQL sink is plausible] Is input expected as a scalar, JSON object, array, field name, regular expression, or query document?
[fingerprint | if structure changes behavior] Which engine and driver are supported by dependencies, errors, response shape, or documented query syntax?
[branch | if the engine is known] Does it expose Mongo-style operators, Couch selectors, Elasticsearch DSL/scripts, or another engine-specific expression surface?
[validation | if an operator reaches the query] Does a bounded true/false selector pair change only the expected synthetic result set?
[impact | if injection is repeatable] What single self-owned record or count proves authorization/filter bypass without broad extraction?

Workflow

Compare scalar, object, array, and malformed controls while preserving the same semantic value.
Fingerprint the backend from at least two signals before using engine-specific syntax.
For Mongo-like stores, test whether operator-shaped keys are rejected or treated as data; avoid server-side script operators.
For Couch/Elastic-style APIs, distinguish an intended query API from an authorization bypass and cap result size.
Confirm with paired selectors against synthetic records and record the driver/engine evidence.

Verification

Require deterministic result or authorization differences from a controlled query structure; parser errors or a public search DSL alone are not findings.

Remediation

Validate schemas, force scalar types, allow-list operators/fields, build queries server-side, disable scripts, and enforce authorization after query resolution.

Safety

No full-index searches, expensive regexes, server-side scripts, or extraction of unrelated documents.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/thanhhai151-security-forge-ai-exploiting-nosql-injection/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

thanhhai151-security-forge-ai-exploiting-nosql-injection.ocm.jsonjson

{
  "ocm": "1",
  "id": "thanhhai151-security-forge-ai-exploiting-nosql-injection",
  "kind": "skill",
  "name": "exploiting-nosql-injection",
  "description": "Test NoSQL query construction for operator, JSON, expression, and query-DSL injection after fingerprinting the database and input context.",
  "publisher": "ThanhHai151",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "data_analysis"
    ],
    "tags": [
      "skill-md",
      "nosql",
      "injection",
      "mongodb",
      "couchdb",
      "elasticsearch",
      "json",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Test NoSQL query construction for operator, JSON, expression, and query-DSL injection after fingerprinting the database and input context."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/ThanhHai151/Security-Forge-AI",
      "path": "ai_framework/skills/exploiting-nosql-injection/SKILL.md",
      "ref": "2d23fb75e221b829aea10f70848df11e96bf6729",
      "url": "https://github.com/ThanhHai151/Security-Forge-AI/blob/2d23fb75e221b829aea10f70848df11e96bf6729/ai_framework/skills/exploiting-nosql-injection/SKILL.md",
      "key": "ThanhHai151/Security-Forge-AI/ai_framework/skills/exploiting-nosql-injection/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "## When to Use\nJSON, form, filter, search, or authentication input is merged into a document/graph/search query or accepts query operators.\n\n## Prerequisites\n- Identify the exact parameter and keep tests read-only and bounded.\n- Use synthetic records and paired controls; do not enumerate an entire collection/index.\n\n## Reasoning Questions\n- [surface] Which request values become filters, operators, projections, scripts, selectors, or full query-DSL objects?\n- [context | if a NoSQL sink is plausible] Is input expected as a scalar, JSON object, array, field name, regular expression, or query docu",
  "cost": {
    "context_tokens": 552
  }
}

Fetch it by URL: GET /api/v1/registry/thanhhai151-security-forge-ai-exploiting-nosql-injection/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.