To test how an actual exploitation works, you can use a vulnerable application made by Snyk (https://github.com/snyk/goof). To run this application, you need to have Node.js and MongoDB installed and properly running in your target server.

You should try an injection attack that bypasses the password check in the admin section. Having a proxy set up, browse to the admin section of your vulnerable application. In this example, it will be http://10.0.2.2:3001/admin. If you submit the user admin and any password, you can see that no access is given.

If you send that request to Repeater, you can see that it is sending two parameters: username and password. You should change the request format to JSON. To do that, you change the value of the Content-Type header and the format of the parameters:

If you submit that request, the server seems to accept it as no errors are generated. So for the sake of clarity, let's use the actual admin password in JSON format to be sure that it is actually accepted:

Now that you know it works, try to inject a condition instead of a password value so that the verification is always true. The query will then say, "If the username is admin and the password is greater than an empty string":

{"username":"admin","password":{"$gt":""}}  

$gt is a special query operator for MongoDB that represents the greater than (>) binary operation. More operators and injection strings can be found at https://github.com/cr0hn/nosqlinjection_wordlists.