API Mass Assignment Scanner
Detects mass assignment vulnerabilities in API endpoints.
What is API Mass Assignment?
API Mass Assignment vulnerabilities occur when APIs automatically bind request parameters to internal objects without filtering. Attackers can modify fields they shouldn't access—like 'isAdmin', 'balance', or 'role'—by simply including them in requests, even when those fields aren't in the API documentation.
Why is This Important?
Mass assignment enables privilege escalation and data manipulation. Attackers can promote themselves to admin, modify prices, change ownership, or access premium features. It's particularly dangerous because there's no visible error—unauthorized modifications simply succeed.
How It Works
1. API Discovery
Automatically discovers API endpoints, methods, parameters, and authentication mechanisms from documentation or traffic.
2. Security Testing
Tests for OWASP API Top 10 vulnerabilities including broken authentication, excessive data exposure, and injection flaws.
3. Compliance Validation
Validates API security against industry standards with detailed findings and remediation guidance.
Key Capabilities
Complete API security coverage aligned with OWASP API Security Top 10 and industry best practices.
- Automatic API endpoint discovery
- Authentication and authorization testing
- Rate limiting and resource exhaustion checks
- Data exposure and sensitive info detection
- API versioning and deprecation analysis
Frequently Asked Questions
How do I find mass assignment vulnerabilities?
Testing methods: add extra parameters to requests (isAdmin=true, role=admin, verified=true), fuzz with common privilege-related field names, examine API responses for hidden fields and try setting them, compare documented fields vs. what the server accepts, and test object updates for unintended field changes.
What fields are commonly exploitable?
Common targets: role/isAdmin/permissions (privilege escalation), balance/credits/price (financial), verified/approved/active (status manipulation), userId/ownerId (horizontal privilege escalation), createdAt/updatedAt (audit bypass), and internal flags like isTest or debug.
Why does mass assignment occur?
Causes: ORMs automatically mapping request body to database models, frameworks with implicit parameter binding, developers not implementing allowlists, trusting client-side filtering, and lack of awareness that hidden fields can be set.
How do I prevent mass assignment?
Prevention: explicitly define allowed fields for each operation (allowlist), use DTOs/view models separate from database entities, implement field-level authorization, never trust client-provided data for sensitive fields, use framework protections (attr_accessible, @JsonIgnore), and validate at multiple layers.
Related Scanners
Ready to secure your application?
Start testing for api mass assignment vulnerabilities today.
Get Started Free