A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Mass assignment lets developers bind an entire HTTP request body to a model object in one line. No field-by-field assignment. No validation of which parameters are acceptable. The framework just maps everything. And if the developer didn't whitelist the allowed fields, you can set admin=true, role=superuser, or confirmed=1 on any registration form.
class User < ActiveRecord::Baseattr_accessible :username, :emailend
That attr_accessible line is the whitelist. Only username and email can be mass-assigned. But remove it—or forget it—and every column in the users table becomes writable through the form. The admin column. The role column. The is_confirmed column. All of them.
Account is pending approval. You review the source code at /opt/asset-manager/app.py. The registration handler checks for a confirmed parameter in the POST body. If present, it sets the database flag to True. If absent, it defaults to False.try:if request.form['confirmed']:cond = Trueexcept:cond = Falsecur.execute('insert into users values(?,?,?)', (username, password, cond))
The developer intended confirmed to be set server-side after admin approval. But the parameter is read directly from the user's POST request. No whitelist. No server-side enforcement. You just add confirmed=test to your registration request.
No admin approval needed. The confirmed parameter was accepted because the code never validated whether the user was authorized to set it. Mass assignment in its simplest form.
Intercept registration and profile update requests in Burp. Add parameters that match database column names you can guess: admin, role, is_admin, confirmed, verified, privilege_level, group_id. If the application accepts them without error and your account properties change, you've found mass assignment. Check the response body and any subsequent profile page for confirmation.
The fix is always the same: explicit whitelisting. In Rails, use strong parameters with permit(). In Flask, validate each field individually. In Django, use ModelForm with explicit fields lists. Never bind raw request data to a model object without filtering.
The gotcha here is that mass assignment doesn't throw errors. The application happily accepts your extra parameters, processes them, and moves on. You won't see a 500 or a validation message. You'll just notice your account suddenly has admin privileges. Silent. Clean. Devastating.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.