Resume.md

What was implemented

This project now demonstrates both read and write NoSQL injection in two modes:

• vuln mode: intentionally unsafe behavior for learning.
• secure mode: validated and ownership-safe behavior.

Main additions made:

1. Added profile fields to user records (age, phoneNumber, bio, department) and updated seeding for all users.
2. Added profile retrieval endpoints in both modes using URL query parameters.
3. Added profile update endpoints in both modes (POST/PUT) to demonstrate write injection.
4. Updated the website search page with a profile editor (view + update) and raw JSON payload testing.
5. Kept URL-bar testing support for profile query injection.

How it works

Read injection

• Vulnerable endpoint takes query params directly and passes them to Mongo filters.
• Example attack style: email[$ne]=wassim@cns.ensia.
• Result: attackers can query unintended records.

Secure endpoint behavior:

• Only allows safe filter keys.
• Requires string values for filters.
• Enforces user ownership for non-admin sessions.

Write injection

• Vulnerable update endpoint builds selector from request body and applies updates with weak checks.
• This enables:
  • Operator injection in selectors ($eq, $ne, etc.).
  • Property injection in updates (for example changing role).

Secure update endpoint behavior:

• Uses strict allowlist for updatable fields.
• Blocks sensitive fields like role, password, passwordHash, _id.
• Validates types/ranges/lengths.
• Always updates only the logged-in user's profile.

Quick demo payload (vuln mode)

Use raw JSON update payload:

{
	"email": { "$eq": "wassim@cns.ensia" },
	"role": "admin",
	"bio": "Injected write demo"
}

Expected in vuln: update can escalate privileges. Expected in secure: request is rejected.

Tips

1. Always run npm run seed before demos to reset the lab state.
2. Keep one terminal running npm run dev during all tests.
3. Test the same payload in both vuln and secure modes to clearly show the difference.
4. For screenshots/reporting, capture: login result, payload used, server response, and final profile state.
5. After any write-injection test, reseed to avoid carrying modified roles into the next test.