Foothold

Back to the login page. I noticed that every time I would insert a single ' into the username field the request would just die. This led me down an SQL injection rabbit hole that led me nowhere until I found something about it possibly being a NoSQL injection vulnerability

Definitely learnt something new that added an entirely new page to my webapp checklist 😄

NoSQL injection | Web Security AcademyWebSecAcademy

Lab: Exploiting NoSQL operator injection to bypass authentication | Web Security AcademyWebSecAcademy

Change Content-Typeand parameter format to json

POST /login HTTP/1.1
Host: shoppy.htb
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 42
Origin: http://shoppy.htb
DNT: 1
Sec-GPC: 1
Connection: keep-alive
Referer: http://shoppy.htb/login
Upgrade-Insecure-Requests: 1
Priority: u=0, i

{"username":"admin", "password":"admin"}