The XSS Rat
CWAP · Module 04 — Broken Access Control

Attack 3 — Mass assignment & parameter-based access control

Animated, step-by-step: discovering hidden object properties and writing the ones the UI never exposed.
Module 04Mass assignmentProperty-levelCritical
—

—

—

◤ Attacker workstation

🐀
you
idle
—

◤ On the wire

◤ Server

key material
—
waiting
attacker
server
hunter@cwap — bash
1× 0:00 / 0:00 step 1 / 1