An operator blacklist | Hunt the Flag

Labs need a computer

Open this page on a computer, or make the browser window larger.

Loading the lab.

Scenario

The developer learned and blocked the ne operator in the password. But document databases have other operators that match anything, like gt with an empty value, so the hole remains.

What you are looking at

The same JSON login, but the server now rejects any password containing the ne operator. Other operators remain unblocked, and some match any password.

Goal

What counts as solved

You signed in as admin with an operator other than ne.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Try ne and note it is blocked.
Recall the other comparison operators.
Use gt with an empty value.
Confirm you signed in as admin.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.

Why the solution worked

Blocking one operator (a blacklist) is not enough; many operators match any value. The fix is forcing values to be strings, not banning specific operators.

The root cause

The blacklist blocks one operator while the structure still accepts objects. The root is not enforcing the value type.

How the code is fixed

Do not chase operators one by one; force the value to be a string.

Vulnerable code

// Blocks $ne only; $gt (and $in, $regex...) still pass.
if (JSON.stringify(req.body).includes('$ne')) return res.status(400).end();

Safe code

// Reject non-string credential values outright, instead of banning operators one by one.
if (typeof req.body.password !== 'string') return res.status(400).end();

Impact in the real world

Operator blacklists are broken by a forgotten operator, and login bypass and data leakage stay possible.

How defenders detect it

Defenders force string types, reject any object in login fields, and alert on $-keys in inputs.

Next level Back to the lesson