Rootme##API — Mass Assignment

4 min readOct 10, 2024

API testing lab

Description:

Your friend thanks you for your previous vulnerability report, and assures you that this time he has removed the possibility of accessing notes, and has even created an administration role!

explanation :

this lab wants us to get the admin privileges so first we go and click on start challenge and brows the pages .

so we can see signup,login,user,note and flag functionalities so we can test all of them and send it’s request to repeater in burpsuite .

so we can see that the request of each page is normal specially signup and login so it’s ok let’s focus on the other three pages (user , flag , note) .

this show how we can get the request with value in our burpsuite

then we can also see the user page by click on execute to get the request .

and click intercept for all the previous screens to get the request and send it to repeater and click on send to see the response .

so the first thing come to my head is to change the request method .
NOTE : the username called xx because when i create the username make it’s user = “xx” and password password = “11” .

now this is the request and response after change the request method to POST .

if we note in the response said that the allowed method is PUT , GET , HEAD ,OPTIONS .

PUT is to send/put data in the parameter .

Get UnStoppable’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

HEAD is to check The size of a resource on the server, If a resource exists on the server or not. The last-modified date of a resource, Validity of a cached resource on the server.

GET is to read data from server .

OPTIONS : is to know the allowed methods for this request .

so we now not interested in OPTIONS because the allowed method is displayed for us in the response and get method is also only read data and we want some thing to change the data .

SO THAT WE WILL TRY USING PUT TO SEE IF THE RESPONSE CONTAIN SOME THING INTERESTING .

we get the same response because it can’t load the json data for the content type so we can add the content type header to make it understand the data we can send .

and now we can set a json data so we can set a { } as body in the request .

now we can it request a parameter called status that exist with our signed account with value “guest” so we can try to change it by send it in the json by PUT request method .