exploiting-mass-assignment-in-rest-apis

What problem does it solve?

This Skill helps security testers discover and validate mass assignment vulnerabilities where APIs accept and persist unexpected client-controlled fields, enabling privilege escalation, financial manipulation, or bypassing verification and authorization controls.

Core Features & Use Cases

• Field Discovery: Compare request and response schemas and use parameter discovery tools to find hidden or accepted fields.
• Injection Testing: Inject common sensitive field names (role, isAdmin, balance, verified, owner_id) into create/update endpoints to verify acceptance.
• Automation & Reporting: Provide an automated agent to iterate field payloads, detect accepted fields, and produce a findings report with remediation guidance.
• Use Case: API security assessment or bug bounty testing on applications using ORM autobinding (Rails, Django, Laravel, Spring) to identify missing allowlists and field-level authorization checks.

Quick Start

Test the target API by sending unexpected JSON parameters to update endpoints and report any accepted restricted fields that allow privilege escalation or business logic manipulation.