Listen to this Post
Introduction:
In the meticulous world of bug bounty hunting, frontend interfaces are often rigorously tested, while the hidden data exchange between client and server remains a goldmine for critical vulnerabilities. Parameters—the data points sent with every request—are the fundamental vectors for these attacks. Understanding their types and locations is the first step in uncovering authorization flaws, injection points, and business logic errors that automated scanners consistently miss.
Learning Objectives:
- Identify and differentiate between the five primary HTTP parameter types: URL, Body, Header, Hidden, and JSON.
- Develop a methodology for systematically testing each parameter type for common vulnerabilities.
- Apply practical command-line and proxy tool techniques to manipulate parameters and validate potential security flaws.
You Should Know:
1. URL & Query Parameters: The Low-Hanging Fruit
URL parameters are the most visible, appearing after the `?` in a web address (e.g., ?id=123&user=admin). They are prime targets for manipulation.
Step‑by‑step guide:
Step 1: Identification. Browse any web application and observe the address bar for parameters during navigation, search, or filtering.
Step 2: Manual Tampering. Change values to test for Insecure Direct Object References (IDOR). For example, change `?invoice_id=1001` to `?invoice_id=1000` to access another user’s data.
Step 3: Automated Testing. Use `ffuf` or `gobuster` for fuzzing. Discover hidden parameters by fuzzing the base URL with a wordlist.
Fuzz for parameters with a common wordlist ffuf -u "https://target.com/api/user?FUZZ=test_value" -w /path/to/parameter-names.txt -fs <size_to_filter_default_responses>
Step 4: Exploitation. Test for SQLi by appending a single quote: ?id=123'. Test for XSS by injecting payloads: ?search=<script>alert(1)</script>.
- Body & POST Parameters: The Form Data Workhorse
When you submit a login form or upload a file, data is typically sent in the HTTP request body as `application/x-www-form-urlencoded` ormultipart/form-data. These parameters are not visible in the URL.
Step‑by‑step guide:
Step 1: Interception. Use Burp Suite or OWASP ZAP to intercept a POST request (e.g., a login, profile update, or checkout process).
Step 2: Analysis. In your proxy, examine the “Params” tab (for URL-encoded) or the raw request body for parameters like username, price, quantity, or role.
Step 3: Manipulation. Change the `price` parameter in a cart submission to a negative number or zero. Alter the `quantity` to an extremely high integer to test for integer overflows. Modify the `role` parameter from `user` to `admin` during a profile update request.
3. Header Parameters: The Metadata You Can Hack
HTTP headers (X-API-Key, User-Agent, X-Forwarded-For) control session handling, authentication, and client context. They are often trusted implicitly.
Step‑by‑step guide:
Step 1: Intercept & Review. Capture any request and switch to the “Headers” tab in your proxy. Look for custom headers, especially those starting with `X-` or Cookie.
Step 2: JWT Tampering. If you find an `Authorization: Bearer "alg": "HS256"), you may be able to forge a token.
Step 3: IP Spoofing. Test for access control flaws by modifying the `X-Forwarded-For` header to spoof an internal IP address like 127.0.0.1.
Step 4: Cache Poisoning. Manipulate headers like `X-Forwarded-Host` to poison cached responses and deliver exploits to other users.
4. Hidden Parameters: The Developer’s “Secret”
These parameters are embedded in HTML forms as <input type="hidden" name="discount" value="0">. Developers use them to pass state data they assume users won’t see or change.
Step‑by‑step guide:
Step 1: Discovery. View the page source (Ctrl+U) or inspect the form element in your browser’s Developer Tools (F12). Search for type="hidden".
Step 2: Proxy Modification. Intercept the form submission request. The hidden parameter and its value will be visible in the intercepted request. Change the `discount` value from `0` to 50, or change `item_price` from `100` to 1.
Step 3: Business Logic Testing. These parameters often control critical business logic. A classic test is modifying a `coupon_code` or `final_price` hidden parameter before the request is sent to the server.
5. JSON Parameters: The Modern API’s Lifeline
Modern APIs and single-page applications communicate almost exclusively using JSON (application/json) in the request body. The structure is hierarchical and can be complex.
Step‑by‑step guide:
Step 1: Intercept API Traffic. Use your proxy while interacting with a modern web app. Look for requests with the `Content-Type: application/json` header.
Step 2: Understand the Schema. The JSON body will look like {"user":{"id":101, "isAdmin":false}, "actions":["read"]}. Identify key-value pairs to target.
Step 3: Targeted Manipulation. Change `”isAdmin”:false` to true. Add new actions to the array: "actions":["read", "write", "delete"]. Perform mass assignment by adding a new parameter like `”plan”:”premium”` at the root level.
Step 4: JSON-specific Injection. Test for NoSQL injection in MongoDB-based APIs by changing a parameter value from a string to a query operator: "username": {"$ne": ""}. Test for SQLi if the JSON values are parsed into a SQL query: "search":"' OR '1'='1".
6. Automating Parameter Discovery with Arjun
Manual discovery is powerful but slow. Tools like Arjun are built specifically to uncover hidden, unseen, or undocumented parameters at scale.
Step‑by‑step guide:
Step 1: Installation. Install Arjun from GitHub.
git clone https://github.com/s0md3v/Arjun.git cd Arjun pip3 install -r requirements.txt
Step 2: Basic Discovery. Run Arjun against a target URL. It will send thousands of requests with potential parameter names.
python3 arjun.py -u https://api.target.com/v1/userinfo
Step 3: Integration with Proxy. Export the results and use them in Burp Suite for active testing. You can also use Arjun’s HTTPie output to directly test discovered parameters with custom payloads.
7. From Parameter to Payout: Validating the Vulnerability
Finding a manipulatable parameter is only half the battle. Proof-of-Concept (PoC) and impact demonstration are key.
Step‑by‑step guide:
Step 1: Establish a Baseline. Document normal, authorized behavior (e.g., “User A can view only their own invoice 1001”).
Step 2: Document the Manipulation. Show the exact parameter changed (e.g., GET /api/invoice?id=1002).
Step 3: Demonstrate Impact. Show the unauthorized result (e.g., “By changing the `id` parameter to 1002, I accessed User B’s invoice containing PII”).
Step 4: Rule Out False Positives. Ensure the issue is not due to cached responses or session mixing. Use two distinct, authenticated sessions in different browsers or proxy instances to conclusively prove the vulnerability.
What Undercode Say:
- The Surface is an Illusion. The real application logic is dictated by parameters, not UI elements. Mastery of parameter manipulation is the single most effective skill for finding logic-based vulnerabilities that evade scanners.
- Context is King. A parameter’s name often reveals its purpose (
isAdmin,amount,debug). Trust this context and test it ruthlessly, as developers often insecurely trust the data they themselves defined.
Analysis: The post outlines a fundamental but often under-practiced methodology. Moving beyond automated payload spraying to a structured understanding of where and how an application accepts data separates novice hunters from consistent earners. The evolution from simple URL tampering to complex JSON mass assignment mirrors the evolution of web technology itself. Future hunters must be adept at parsing API schemas (OpenAPI/Swagger) and GraphQL queries, as these will be the primary homes for the next generation of “hidden parameters.” The core principle, however, remains unchanged: if the client can control it, you must test it.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Kiransai Pasupuleti – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
