Software Development
Hunt API Misconfig
Hunt API security misconfiguration — mass assignment, JWT attacks, prototype pollution, CORS, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT: alg=none, weak HMAC bruteforce, kid path traversal, JWK injection, token confusion. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). CORS: wildcard with credentials, null origin, regex with subdomain takeover, postMessage origin checks. HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io), CORS preflight responses. Use when hunting API misconfigs, JWT flaws, mass-assignment, prototype pollution, CORS bypasses.
- Publisher / source
- adriannoes/awesome-agentic-ai (found on the CSV list)
- Upstream record
- adriannoes/awesome-agentic-ai
- Version
- Version 2
- Published
- Publication review
- Approved for publication
- Content fingerprint
cfdcdfcbbfd4543efb523b78036b890f28f2d956144ab4d7e4a3b0e5b8dfe1ec