Vulnerabilities
Confirm NoSQL injection on MongoDB-backed params
MongoDB-focused NoSQL injection scanner and injector.
overview
What nosqli does
nosqli sits after parameter discovery. Feed parameterized URLs or captured requests so injection probes hit inputs the app already accepts.
Reach for it when a MongoDB-backed endpoint takes user input and you need confirmation, not a guess. It finds injectable parameters and demonstrates the injection.
Trickest runs nosqli as a managed Vulnerabilities node: --target, --request, or --data in; FILE and FOLDER out. Prefer sqlmap when the store is relational SQL.
use cases
Where nosqli fits
Test a URL for NoSQL injection
Point nosqli at a parameterized URL to detect injectable inputs and confirm the injection, focusing on MongoDB-backed endpoints.
Replay a captured request
Load a request saved from Burp or ZAP so the scan reproduces the exact headers and body the application expects before injecting.
Test POST endpoints
Supply default POST data so form and API endpoints get tested for injection, not only query-string parameters.
Inspect traffic through a proxy
Route requests through a proxy to watch the injection payloads and responses while validating a finding by hand.
reference
nosqli inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | --target | Target URL, e.g. http://site.com/page?arg=1. |
| request | FILE | --request | Load a request from a file, such as one generated in Burp or ZAP. |
| data | STRING | --data | Default POST data (without any injection strings). |
| https | BOOLEAN | --https | Always send requests as HTTPS (defaults to HTTP with request files). |
| proxy | STRING | --proxy | Proxy requests through this proxy URL. |
| user-agent | STRING | --user-agent | Specify a custom user agent. |
| config | FILE | --config | Config file. |
Showing key inputs. nosqli exposes 7 inputs in total.
example
Run nosqli
# scan a parameterized URL for NoSQL injectionnosqli scan --target 'http://example.com/user/lookup?user=guest' --data 'role=user' --proxy http://198.51.100.10:8080Scanning http://example.com/user/lookup?user=guest Testing parameter: userTesting parameter: role Found the following NoSQL injections: Type: Boolean-based blind URL: http://example.com/user/lookup?user[$ne]=guest Param: user 1 injection found on http://example.com/user/lookupguidance
Choosing nosqli
Use nosqli when user-controlled input may reach a NoSQL query, especially MongoDB. Feed parameterized URLs or captured requests from a crawl. Use sqlmap when the backend is a SQL database.
sqlmap
Standard SQL injection tester for relational databases. nosqli covers the NoSQL case sqlmap does not; pick by backend type.
dalfox
Parameter-focused XSS scanner. nosqli targets NoSQL injection on the same class of parameterized endpoints.
commix
Command-injection scanner. nosqli stays on the NoSQL query layer rather than OS command execution.
faq
nosqli questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run nosqli yourself
Katana crawls a target for parameterized URLs, then nosqli tests them for NoSQL injection and writes the injectable endpoints as a queryable output.
Facts on this page come from the live Trickest tool library.