# Tanuki

> Tanuki is usually a XXE lab, but for today only, the hint stated ***mass assignment.***

After registering, I was kinda lost. Mainly because I'm used to the fact that this is the XXE lab, and I could find any point clicking though the frontend that would hint towards a mass assignment vulnerablility. That was until I reviewed all the requests in BurpSuite. In the request where I registered I noticed a role property.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2Fd6dMKFqe9jye941dVQdq%2Fafbeelding.png?alt=media&#x26;token=e4909cb7-0de8-41ce-b133-b50330a6c59a" alt=""><figcaption></figcaption></figure>

So what I did next was try to register another user, but with the role "admin".

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FfLAwpNyZsiu7mgkg7ejO%2Fafbeelding.png?alt=media&#x26;token=34e6f480-9217-4094-b95b-be84db80cc79" alt=""><figcaption></figcaption></figure>

I got back a 200 from that request with the request and the response showing `"role":"admin"`. So I tried logging in as shadow2.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FVdAhbw92NfS2VovTlMqu%2Fafbeelding.png?alt=media&#x26;token=a2ff3df8-0680-4b27-8b64-0ee15353c5df" alt=""><figcaption></figcaption></figure>

And saw that shadow2 had admin rights and could see the flag 🇧🇪
