‫Instructor: Hi, within this lecture,
‫we are gonna take a look
‫at the API6 challenge.
‫Now, we are at the
‫API6.
‫It says the Mass Assignment.
‫And uh we have a clue.
‫We have a hint again for the Mass Assignment.
‫It says that,
‫"welcome to our store.
‫We will give you credits
‫if you behave nicely.
‫Our credit management is super secure."
‫Great.
‫Now if we sign up for a an account,
‫like if we sign up with a username and a password,
‫I believe we're gonna get something back
‫like a credit back.
‫And let's see.
‫So we already have two endpoints over here.
‫We just gonna give the username, and password,
‫and address, and mobile number.
‫Then we can just get the user's details
‫in the next endpoint.
‫So this is pretty standard.
‫So I'm just gonna come over here
‫to create user and go to body.
‫And here you go.
‫In the test again,
‫we get an authentication key once we do that.
‫So I'm just gonna go for the name,
‫username, and password.
‫And name, username,
‫I'm just gonna write my own name.
‫Password, I'm just gonna write atil123.
‫If we do that, we get the name, username, and id.
‫Okay.
‫So if I go to get user,
‫if I just send this as a request,
‫and by the way
‫over here we see something like "userme".
‫So let's try to see
‫if there's something like that.
‫It asks for an id,
‫but over here we see userme.
‫Maybe it works with the authentication key.
‫Yeah, here you go.
‫So I believe the developer
‫has changed this a little bit
‫because we don't see any address or mobile.
‫Nor over here.
‫But we see id, name, username.
‫Again, it doesn't matter
‫because if I try to change
‫this to one to something like that
‫as you can see we are not getting this.
‫I believe we should stick to the latest version
‫and just write it or run this as me.
‫And here you go.
‫The idea over here is
‫that we have an extra parameter
‫over here called "credit".
‫Okay.
‫And it gets it with my authentication key.
‫And as far as the body concerned,
‫we are not sending anything back.
‫We are getting the right ID name and username,
‫but we are getting the credit as zero.
‫Okay.
‫So what can we do?
‫We can try to send this name,
‫username, and password,
‫but maybe we can try to add the credit
‫as a parameter to ourselves.
‫Like, we can just send this credit
‫even if it's not asked us to do, right?
‫We can't try that.
‫We can try to create a new user with it
‫and maybe it'll work, maybe it'll not.
‫Let's see.
‫So what I'm going to do,
‫I'm going to come over here.
‫So aside from the name, username, and password,
‫these are all
‫required parameters.
‫If we don't send them, it won't work.
‫But maybe if we add some new parameter
‫that we know that it exists in the database,
‫maybe it'll work.
‫So I'm gonna change the name and user name.
‫Okay, I'm gonna change it to Atlas.
‫And I'm gonna add a new parameter.
‫I'm gonna say credit.
‫And for the credit I'm just gonna write
‫some random number like 500,
‫okay?
‫It doesn't matter what you write,
‫but don't forget about Tacomas
‫and make sure that you
‫have respected the JSON format.
‫Otherwise it won't work.
‫So if I send this,
‫okay, I get an ID back, great.
‫Maybe I can just go ahead
‫and try to
‫see
‫if this authentication token has been renewed.
‫Yep.
‫Now I will send this
‫and here you go.
‫Now I have the credit.
‫Okay, I have the atlas,
‫I have the credit, and I have the flag.
‫Now what did I do?
‫I have seen the credit parameter in the get.
‫So I have told that
‫why not
‫just add this as a parameter in the post request as well?
‫So, it should have checked against it,
‫but it didn't.
‫And like in the real life
‫there are a lot of APIs
‫you can find it like this admin, true. okay?
‫Because they're all sending
‫this by default admin, false.
‫Even if you don't see it,
‫you can try to add this.
‫So I believe this was a great example
‫of the Mass Assignment vulnerability.
‫So rather than the admin,
‫of course we are sending credit 500.
‫But again,
‫if you don't wanna do it in the postman
‫you can also send this to Bur Suite, okay?
‫You can see the thing over here.
‫You can just send this to repeater
‫and try and repeat the process over there
‫so that you can see it yourself.
‫So I'm gonna turn this off
‫because we already have seen that.
‫Great.
‫Now
‫we are good to go
‫with the API6.
‫Now I'm gonna stop here
‫and continue within the next one.