Exploiting Mass Assignment In Rest Apis

Mahipal

Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable fields on ORM-backed endpoints (Rails, Django, Laravel, Spring).

Install

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-mass-assignment-in-rest-apis

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-mass-assignment-in-rest-apis -a claude-code -g

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-mass-assignment-in-rest-apis -a codex -g

gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/exploiting-mass-assignment-in-rest-apis

gh skill install mukul975/Anthropic-Cybersecurity-Skills exploiting-mass-assignment-in-rest-apis

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/exploiting-mass-assignment-in-rest-apis ~/.claude/skills/exploiting-mass-assignment-in-rest-apis   # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/exploiting-mass-assignment-in-rest-apis ~/.agents/skills/exploiting-mass-assignment-in-rest-apis   # Codex, Cursor, Gemini CLI, Copilot, OpenCode

Install

Related