Create Lab 2: Exploiting NoSQL operator injection to bypass authentication.md

Author: Esther7171

Wpt/Server Side vulnerability/NoSQL injection/Labs/Lab 2: Exploiting NoSQL operator injection to bypass authentication.md

@@ -0,0 +1,26 @@
+# Lab 2: [Exploiting NoSQL operator injection to bypass authentication](https://portswigger.net/web-security/nosql-injection/lab-nosql-injection-bypass-authentication)
+
+![image](https://github.com/user-attachments/assets/bc791cbd-490d-47e3-abca-5469af225386)
+
+In this lab scenario,the login functionality is backed by a MongoDB NoSQL database and is vulnerable to injection using MongoDB query operators.
+
+Objective: Exploit the NoSQL injection vulnerability to log in as the `administrator` user.
+
+You can also log in to your own account using the following credentials:
+* Username: `wiener`
+* Password: `peter`
+
+![image](https://github.com/user-attachments/assets/2c93e330-d90f-44c9-b9b1-42e9d8d6dbf2)
+
+### Accessing the Lab
+Step 1: Click on "My Account".
+
+![image](https://github.com/user-attachments/assets/02dcaf39-0a1b-4c95-8cf9-d431b84b7cc7)
+
+* Get Login with gievn credentials `wiener:peter`
+* Open Burp Suite and ensure Intercept is turned ON.
+* Login and capture the request in Burp.
+
+![image](https://github.com/user-attachments/assets/b1619aab-8e6e-4774-bb8b-7972b7953fb1)
+
+Send this Request to Repeater to check