OWASP Security Shepherd Project - NoSQL Injection One (Injection Challenge)

Challenge

Solution

    Let's try to click at the Get Gamer Info button without any modification and use BurpSuite for capturing the requests.
(If you don't know what is BurpSuite, here is the official website of it: https://portswigger.net/burp)

    Don't forget to redirect your browser to BurpSuite for capturing and analysis the requests & responses.

    Let's try to manipulate this field by input b' OR '1' = '1.

    No luck, but now we know the application is using MongoDB.
    By checking the OWASP Testing Guide: https://www.owasp.org/index.php/Testing_for_NoSQL_injection, we know that we can input some function or special characters for NoSQL.
Let's try to input a'; return(true); var a = 'a.

Great! We finished the challenge.