NoSQL Injection 4 | Exploiting NoSQL Operator Injection to Extract Unknown Fields

[@MuhammadUsman-xk1cu]

I was solving the lab to myself but got stuck on the password reset token now watching your video everything is clear to me.

[@LMeasy]

bro nice vid. Just 1 question: if ID consists of 2 letters, why we got true with the match condition with index 0-1-2-3 in the regex? match(2) and match(3) should return false (so invalid pw, and not true (locked account)) thank you, this one last puzzle is missing for me

[@ragunathr2313]

In real world, how many concurrent request we can use and what will happen if we use 10 or 30??

[@HMCyberAcademy]

If the server has any firewall or IDS/IPS in place, then it detects all abnormal activity, in this case 30 concurrent requests. It would either block you(Your IP) or disable your account (if you are already logged in). To avoid suspicion, we use less concurrent requests.