skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

exploiting-mass-assignment-in-rest-apis

Detect and exploit mass assignment vulnerabilities in REST APIs.

2|Updated Apr 14, 2026
Search Tags:#automation#orm#api-security#rest-api#privilege-escalation#burp-suite#mass-assignment
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill exploiting-mass-assignment-in-rest-apis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-mass-assignment-in-rest-apis
Source: https://github.com/Acczdy/MoZiSec/tree/main/web-security/.claude/skills/exploiting-mass-assignment-in-rest-apis
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill exploiting-mass-assignment-in-rest-apis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security testers discover and validate mass assignment vulnerabilities where APIs accept and persist unexpected client-controlled fields, enabling privilege escalation, financial manipulation, or bypassing verification and authorization controls.

Core Features & Use Cases

  • Field Discovery: Compare request and response schemas and use parameter discovery tools to find hidden or accepted fields.
  • Injection Testing: Inject common sensitive field names (role, isAdmin, balance, verified, owner_id) into create/update endpoints to verify acceptance.
  • Automation & Reporting: Provide an automated agent to iterate field payloads, detect accepted fields, and produce a findings report with remediation guidance.
  • Use Case: API security assessment or bug bounty testing on applications using ORM autobinding (Rails, Django, Laravel, Spring) to identify missing allowlists and field-level authorization checks.

Quick Start

Test the target API by sending unexpected JSON parameters to update endpoints and report any accepted restricted fields that allow privilege escalation or business logic manipulation.

Frequently Asked Questions about exploiting-mass-assignment-in-rest-apis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect mass assignment vulnerabilities in REST APIs?▼

Find hidden API fields by comparing request and response schemas and using parameter discovery tools to identify accepted fields not exposed in the normal application interface.

Does this mass assignment test work with Django and Rails ORM autobinding?▼

This test targets frameworks with ORM autobinding like Django, Rails, Laravel, and Spring, where JSON payloads are automatically bound to ORM models without explicit field allowlists.

How do I test for privilege escalation via API parameter injection?▼

Test for privilege escalation by injecting sensitive field names such as isAdmin, balance, or owner_id into create and update endpoints to verify if the API accepts unauthorized modifications.

What is mass assignment in REST APIs and when does it occur?▼

Mass assignment occurs when REST APIs automatically bind client-controlled JSON to ORM models, allowing attackers to overwrite restricted fields and bypass authorization or verification controls.

Do I need Burp Suite to automate mass assignment testing?▼

You do not need Burp Suite as a hard dependency; the Skill relies on the Python requests library to automate field payload iteration and detect accepted fields, though Burp Suite can aid initial parameter discovery.

Related Skills

Explore More Software Engineering Skills→
AcczdyAcczdy
2

testing-for-broken-access-control

Detect broken access control by replaying requests across authentication contexts.

Community
Intermediate
fatihkanfatihkan
7

sc-graphql

Detect GraphQL vulnerabilities in schemas, resolvers, and dependencies.

Community
Advanced
YlikenYliken
5

api-recon-and-docs

Discover reachable API endpoints, schemas, and documentation across REST, GraphQL, and mobile APIs.

Community
Intermediate
RIMTHAN-LABRIMTHAN-LAB
1

owasp-mobile-security-checker

Analyze Flutter applications for OWASP Mobile Top 10 vulnerabilities.

Official
Intermediate