mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is analyzing a Bash script…
A penetration tester is analyzing a Bash script that uses the tool 'curl' to send HTTP requests. The script contains the following line: curl -X POST -d "username=admin&password[$ne]=a" http://target/login. Which type of attack is this script most likely attempting?
⚠ Common exam trap
The trap here is that candidates see a POST request with parameters and immediately think SQL injection, but the square bracket syntax `[$ne]` is a dead giveaway for NoSQL injection, which is a distinct attack vector targeting document-based databases.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NoSQL Injection
The payload `password[$ne]=a` uses MongoDB's `$ne` (not equal) operator, which is a NoSQL query operator. When the backend parses this as a MongoDB query, it will match any document where the password is not equal to 'a', effectively bypassing authentication. This is a classic NoSQL injection attack, not SQL injection, because the syntax targets NoSQL databases like MongoDB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) is a client-side injection flaw where an attacker embeds malicious JavaScript into web pages, which then executes in a victim's browser. The payload in this bash script uses MongoDB operators like $ne in a POST data field, targeting server-side authentication logic rather than injecting HTML or script tags into a rendered page. There is no reflection into a browser context, no event handler, and no JavaScript execution path, so XSS cannot occur.
- ✗
SQL Injection
Why it's wrong here
SQL Injection exploits vulnerabilities in SQL query construction by inserting SQL syntax—such as single quotes, UNION, or OR 1=1—to alter query behavior. The payload here uses the $ne operator, which is specific to JSON-based NoSQL query languages like MongoDB, not SQL. A SQL database would reject $ne as invalid syntax, and the attack vector is a POST data field feeding a document query, not a SQL statement, so this is not SQL injection.
- ✓
NoSQL Injection
Why this is correct
NoSQL Injection is the correct answer: the $ne operator is a MongoDB comparison operator meaning 'not equal to.' By injecting a JSON object like {"password": {"$ne": null}} into the password field, the attacker causes the authentication query to return true for any non-null password value, effectively bypassing login. This occurs because the application naively concatenates unsanitized user input into the NoSQL query structure, allowing operator injection into the query logic.
- ✗
Directory Traversal
Why it's wrong here
Directory Traversal involves manipulating file path references—for example, using ../ or encoded variants like %2e%2e%2f—to access files outside the intended directory. The payload analyzed here is in a POST data field and contains MongoDB query operators that target an authentication mechanism, not a file system path. There is no path parameter, no filename manipulation, and no attempt to read arbitrary files, so this technique is entirely unrelated to the attack.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
Bash script
A Bash script is a text file containing a sequence of commands for the Unix shell Bash, allowing users to automate repetitive tasks and streamline system administration on Linux and macOS.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.