Web on Zero's Blog

0x4 - Learn CTF: Web Exploitation

Tue, 24 Feb 2026 12:58:00 +0700

Table of Contents

No SQL Injection (picoCTF)

Summary

Category: Web / NoSQL Injection
Challenge: No SQL Injection
Target: http://atlas.picoctf.net:54182/
Goal: bypass login and recover flag token.

Source analysis

From server.js, login handler parses user input like this:

email:
  email.startsWith("{") && email.endsWith("}")
    ? JSON.parse(email)
    : email,
password:
  password.startsWith("{") && password.endsWith("}")
    ? JSON.parse(password)
    : password,

Then it performs:

User.findOne({ email: <parsed>, password: <parsed> })

So if we send JSON object strings, they become Mongo operators instead of plain strings.