testing-api-for-mass-assignment-vulnerability

# Testing API for Mass Assignment Vulnerability ## When to Use - Testing API endpoints that accept JSON/XML request bodies for user profile updates, registration, or object creation - Assessing whether the API binds all client-supplied properties to the data model without an allowlist - Evaluating if users can set privileged attributes (role, permissions, pricing, balance) through regular update endpoints - Testing APIs built with ORMs that auto-bind request parameters to database models - Validating that server-side input validation restricts writeable properties per user role **Do not use** without written authorization. Mass assignment testing involves modifying object properties in potentially destructive ways. ## Prerequisites - Written authorization specifying target API endpoints and scope - Test accounts at different privilege levels - API documentation or OpenAPI specification to identify expected request fields - Burp Suite Professional for request interception and parameter injection - Python 3.10+ with `requests` library - Knowledge of the backend framework (Rails, Django, Express, Spring) to predict parameter binding behavior ## Workflow ### Step 1: Identify Writable Endpoints and Expected Parameters ```python import requests import json import copy BASE_URL = "https://target-api.example.com/api/v1" user_headers = {"Authorization": "Bearer <user_token>", "Content-Type": "application/json"} # Identify endpoints that accept write operations writable_endpo...