> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2024/web-exploitation/no-sql-injection-medium.md).

# No Sql Injection (Medium)

<figure><img src="/files/D3Sbwz0qHzAzCXCaTOsY" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/gipSaHVGoYwNRWt0ipFc" alt=""><figcaption></figcaption></figure>

***

I suspect from a challenge in PicoCTF 2025, that I'll be using Burp Suite since the title of the challenge is "No Sql". I tried to enter some random values and it gave no hints. Since it wasn't really a output website (like where you could use for {{7\*7} }" to test for Jinja.&#x20;

<figure><img src="/files/tp2nsjAEh0BZrMZddi0E" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/9ZqCWInQvLXqPMbI1wgR" alt=""><figcaption></figcaption></figure>

Using the proxy feature, it tells us it uses a JSON list, and for the intruder option I couldn't really find a way to fuzz the inputs. I then looked back at the NoSQL injections and tried out a couple more.

```json
{"$ne": null} 
/// this outputs { "username": {"$ne": null} }, and this bypass user filtering and returns all results
// $ne is a MongoDB query operator (not equal), null means the field has no value
```

By putting this command into the username and password, I was able to access the other html.&#x20;

<figure><img src="/files/Chi1UhrMedZ2hSaQjAgq" alt=""><figcaption></figcaption></figure>

It worked, but there wasn't much from this page. I realized I then needed to intercept in Burp Suite to see the outputs.

After using the same login/passwords, I sent the POST request using the injection to the Repeater.

{% hint style="info" %}

### Why use Repeater?

* **Manual testing** - Lets you modify and resend requests repeatedly
* **No browser needed** - Direct HTTP communication with the server
* **Immediate feedback** - See responses instantly
* **Easy iteration** - Test multiple payload variations quickly
  {% endhint %}

<figure><img src="/files/1frmIOjYrv35K30cBKfW" alt=""><figcaption></figcaption></figure>

And there it was, the flag in base 64!&#x20;