Mass Assignment & Hidden Fields
Send the fields the UI never sends. The schema is the attack surface.
Tags: mass-assignment, priv-esc, api
Level: intermediate
Method
Diff UI vs schema
GraphQL introspection, OpenAPI, JS types, Rails form helpers. List every writable field.
Tools: clairvoyance, arjun, jsluice
Add the dangerous keys
role, isAdmin, verified, balance, price, tenantId, twoFactorEnabled, account_type on register and PATCH /me.
Tools: Burp Suite
Nested and JSON-over-form
user[role]=admin, JSON body on an endpoint that also accepts form, HTTP parameter pollution.
Field notes
- A field that sticks in the response but is ignored by authz is not priv-esc. Prove the new role on a gated endpoint.
- GraphQL input types hide more than REST. Introspect them.