Behind every exploit, there’s knowledge. Here’s what to know before injecting.

🧨 Introduction

In a world where every developer fears SQL injections like the plague, a new era of databases has emerged, promising simplicity, scalability… and, wrongly, security.

MongoDB, CouchDB, Firebase: their names sound like promises of modernity. With their JSON syntax, flexible schema and rapid integration into modern web applications, they have become the stars of Javascript stacks. And yet… behind this facade of “SQL-free” technology lies an insidious threat.

Because many people have forgotten a fundamental truth when they run away from classic SQL queries : any unsecured interface is an open door, whatever the language or format.

For years, developers thought that injections were just a relational database problem. “NoSQL ? Not concerned.” Wrong. And dangerous.

In this article, we’ll dive into what you need to know before moving on to NoSQL injection.

Are you ready ? Because once you’ve seen what a simple, poorly protected request can do you’ll never see your JSON in the same way again.