Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-29 16:10:54 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #807 from heinosasshallik/patch-4

Browse source 
Update nosql-injection.md: clarify aggregate() requirement
This commit is contained in:
Carlos Polop 2024-03-03 10:47:38 +01:00 committed by GitHub
commit cee05a9786
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pentesting-web/nosql-injection.md
View file

@ -125,6 +125,8 @@ Using the **$func** operator of the [MongoLite](https://github.com/agentejo/cock
It's possible to use [**$lookup**](https://www.mongodb.com/docs/manual/reference/operator/aggregation/lookup/) to get info from a different collection. In the following example, we are reading from a **different collection** called **`users`** and getting the **results of all the entries** with a password matching a wildcard.
**NOTE:** `$lookup` and other aggregation functions are only available if the `aggregate()` function was used to perform the search instead of the more common `find()` or `findOne()` functions.
```json
[
{