{"id":8845,"date":"2021-02-19T12:52:09","date_gmt":"2021-02-19T07:22:09","guid":{"rendered":"https:\/\/www.varutra.com\/?p=8845"},"modified":"2023-03-24T12:08:15","modified_gmt":"2023-03-24T06:38:15","slug":"http-parameter-pollution","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/","title":{"rendered":"HTTP Parameter Pollution"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" src=\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution-1024x573.png\"  class=\"sh-overlay-item sh-table-cell ls-is-cached lazyloaded\" data-rel=\"lightcase\" title=\"HTTP Parameter Pollution - Varutra Consulting\"><br \/>\nThe parameter enables pages to load data from the back-end e.g., ID, search query. They make websites more interactive to the back-end as well as make them easy to use for visitors. Multiple parameters can be added with the help of special chars like <strong>(&amp;, +,;) <\/strong>to a single page, which makes the page dynamic and a single page can have multiple views. Pages accept only parameters defined by developers in code and they should be sanitized properly to avoid malicious activity.<\/p>\n<p>e.g.\u00a0 <a href=\"https:\/\/websiteurl.com\/dish?organization?uid=23\">https:\/\/websiteurl.com\/dish?organization?uid=23<\/a><\/p>\n<p>HTTP Parameter Pollution is simply adding one extra parameter with a similar one used by the server. We can bypass the Web application firewall (WAF) checks that used for input validation checkpoints and Ruleset for blacklisting through parameter pollution. Behind the scenes, the front-end checks for validation on only one parameter, and another parameter get passed to the back end without checks.<\/p>\n<p>e.g.\u00a0 <a href=\"https:\/\/websiteurl.com\/dish?organization?uid=23&amp;uid25\">https:\/\/websiteurl.com\/dish?organization?uid=23&amp;uid25<\/a><\/p>\n<p>Firstly, need to gather information about the backend and parsing method used by the application. Then need to find parameters that are taking input from the user and check how it behaves after parameter tempering. Parameter Pollution can be tested against GET request parameter, POST parameters, and in the Cookie header.<\/p>\n<p>Different languages and frameworks handle these parameters differently, some consider the first parameter and some of them will go for the second parameter and some will combine the second parameter with the first parameter. For exploitation, an attacker needs to craft a payload according to the back end of the web application.<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Here is a List of Some <\/strong><strong>Back-end<\/strong><strong> Server that Supports the First Occurrence only:<\/strong><\/h3>\n<ul>\n<li>JSP, Servlet\/Apache Tomcat<\/li>\n<li>JSP, Servlet\/Oracle Application Server<\/li>\n<li>JSP, Servlet\/Jetty<\/li>\n<li>IBM HTTP Server<\/li>\n<li>mod_perl, libapreq2\/Apache<\/li>\n<li>Perl CGI\/Apache<\/li>\n<li>mod_wsgi (Python)\/Apache<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Back-end<\/strong><strong> Server that Supports the Second Occurrence only:<\/strong><\/h3>\n<ul>\n<li>PHP\/Apache<\/li>\n<li>PHP\/Zeus<\/li>\n<li>IBM Lotus Domino<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Back-end<\/strong><strong> Server that Supports All Occurrence:<\/strong><\/h3>\n<ul>\n<li>NET\/IIS<\/li>\n<li>ASP\/IIS<\/li>\n<li>Python\/Zope<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Exploitation Scenario for<\/strong><strong> Parameter Pollution:<\/strong><\/h3>\n<p>In this section, we will be discussing the exploitation of Parameter Pollution in Business Logic flow. Here is an application that provides services for online food ordering.<\/p>\n<ol>\n<li><strong>Request for ordering food to cart.<\/strong><\/li>\n<\/ol>\n<p style=\"text-align: center\"><strong><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-8846 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/Adding-Item-to-Cart.png\" alt=\"Adding Item to Cart\" width=\"554\" height=\"284\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/Adding-Item-to-Cart.png 554w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/Adding-Item-to-Cart-300x154.png 300w\" sizes=\"(max-width: 554px) 100vw, 554px\" \/><\/strong><\/p>\n<p style=\"text-align: center\"><strong>Fig. &#8211; Adding It<\/strong><strong>e<\/strong><strong>m to Cart.<\/strong><\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<ol start=\"2\">\n<li><strong>Intercept Request in BurpSuite and Temper qty Parameter.<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-8847 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/Performing-Parameter-Pollution-on-qty-parameter.png\" alt=\"Performing Parameter Pollution on qty parameter\" width=\"631\" height=\"270\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/Performing-Parameter-Pollution-on-qty-parameter.png 631w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/Performing-Parameter-Pollution-on-qty-parameter-300x128.png 300w\" sizes=\"(max-width: 631px) 100vw, 631px\" \/><\/p>\n<p style=\"text-align: center\"><strong>Fig. &#8211; Performing <\/strong><strong>Parameter<\/strong><strong> Pollution on qty parameter<\/strong><\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<ol start=\"3\">\n<li><strong>Negative Number of Dishes Gets Added to Cart<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-8848 size-full\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/Parameter-Pollution-exploited-Successfully.png\" alt=\"HTTP Parameter Pollution exploited Successfully\" width=\"561\" height=\"269\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/Parameter-Pollution-exploited-Successfully.png 561w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/Parameter-Pollution-exploited-Successfully-300x144.png 300w\" sizes=\"(max-width: 561px) 100vw, 561px\" \/><\/p>\n<p style=\"text-align: center\"><strong>Fig. &#8211; Parameter Pollution exploited Successfully<\/strong><\/p>\n<p><strong>\u00a0<\/strong>Parameter Pollution is a test case, it is not vulnerability by itself, but it can be chained with another vulnerability. It can be used for URL rewriting, chaining behavior of the application. Parameter Pollution impact depends on context or web application functionality. Parameter Pollution affects server-side as well client-side components.<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Signs That HTTP <\/strong><strong>Parameter <\/strong><strong>Pollution <\/strong><strong>is<\/strong><strong> Present in Web Application: <\/strong><\/h3>\n<ul>\n<li>HTTP parameters get override on adding an extra parameter<\/li>\n<li>The application behaves differently for adding an extra parameter<\/li>\n<li>Access and potentially exploit uncontrollable variables<\/li>\n<li>Application improperly validating extra parameter<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Vulnerabilities Can be Found with HTTP Parameter Pollution:<\/strong><\/h3>\n<ul>\n<li>SQL Injection LDAP Injection, XML Injection, XPath Injection, Command Injection, XSS.<\/li>\n<li><a href=\"https:\/\/www.varutra.com\/varutratheme\/insecure-direct-object-reference-idor\/\">IDOR<\/a> through parameter pollution report ( <a href=\"https:\/\/0xgaurang.medium.com\/case-study-bypassing-idor-via-parameter-pollution-78f7b3f9f59d\">https:\/\/0xgaurang.medium.com\/case-study-bypassing-idor-via-parameter-pollution-78f7b3f9f59d<\/a> )<\/li>\n<li>Account takeover through parameter pollution report ( <a href=\"https:\/\/medium.com\/@0xankush\/readme-com-account-takeover-bugbounty-fulldisclosure-a36ddbe915be\">https:\/\/medium.com\/@0xankush\/readme-com-account-takeover-bugbounty-fulldisclosure-a36ddbe915be<\/a> )<\/li>\n<li>Business Logic<\/li>\n<\/ul>\n<p><strong>\u00a0<\/strong><\/p>\n<h3><strong>Countermeasures For HTTP Parameter Pollution:<\/strong><\/h3>\n<ol>\n<li>Context Data validation<\/li>\n<li>Output encoding<\/li>\n<li>Filtering is the key to defend our systems<\/li>\n<li>Apply URL Encoding<\/li>\n<li>Use of strict regex in URL Rewriting<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<h3><strong>References:<\/strong><\/h3>\n<ol>\n<li>https:\/\/owasp.org\/www-project-web-security-testing-guide\/latest\/4- Web_Application_Security_Testing\/07-Input_Validation_Testing\/04-Testing_for_HTTP_Parameter_Pollution<\/li>\n<li><a href=\"http:\/\/www.madlab.it\/slides\/BHEU2011\/whitepaper-bhEU2011.pdf\">http:\/\/www.madlab.it\/slides\/BHEU2011\/whitepaper-bhEU2011.pdf<\/a><\/li>\n<li><a href=\"https:\/\/owasp.org\/www-pdf-archive\/AppsecEU09_CarettoniDiPaola_v0.8.pdf\">https:\/\/owasp.org\/www-pdf-archive\/AppsecEU09_CarettoniDiPaola_v0.8.pdf<\/a><\/li>\n<li><a href=\"https:\/\/www.acunetix.com\/blog\/whitepaper-http-parameter-pollution\">https:\/\/www.acunetix.com\/blog\/whitepaper-http-parameter-pollution<\/a><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Author,<\/p>\n<p><strong>Abhijit Karande<\/strong><\/p>\n<p>Attack &amp; Pentest Team<\/p>\n<p>Varutra Consulting Pvt. Ltd.<\/p>","protected":false},"excerpt":{"rendered":"<p>The parameter enables pages to load data from the back-end e.g., ID, search query. They make websites more interactive to the back-end as well as&#8230;<\/p>\n","protected":false},"author":4,"featured_media":8849,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[57,272],"tags":[339,144,346],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 4.6.3 - aioseo.com -->\n\t\t<meta name=\"description\" content=\"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.\" \/>\n\t\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t\t<link rel=\"canonical\" href=\"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.6.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Varutra Consulting\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"HTTP Parameter Pollution (HPP) and Exploitation Scenario\" \/>\n\t\t<meta property=\"og:description\" content=\"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1060\" \/>\n\t\t<meta property=\"og:image:height\" content=\"593\" \/>\n\t\t<meta property=\"article:section\" content=\"Web Application Security\" \/>\n\t\t<meta property=\"article:tag\" content=\"http\" \/>\n\t\t<meta property=\"article:tag\" content=\"vulnerability\" \/>\n\t\t<meta property=\"article:tag\" content=\"web application\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-02-19T07:22:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-24T06:38:15+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"HTTP Parameter Pollution (HPP) and Exploitation Scenario\" \/>\n\t\t<meta name=\"twitter:description\" content=\"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"kalpblogger\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#article\",\"name\":\"HTTP Parameter Pollution (HPP) and Exploitation Scenario\",\"headline\":\"HTTP Parameter Pollution\",\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/HTTP-Parameter-Pollution.png\",\"width\":1060,\"height\":593,\"caption\":\"HTTP Parameter Pollution\"},\"datePublished\":\"2021-02-19T12:52:09+05:30\",\"dateModified\":\"2023-03-24T12:08:15+05:30\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#webpage\"},\"articleSection\":\"Vulnerability Disclosure, Web Application Security, HTTP, Vulnerability, Web Application\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"nextItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#listItem\"},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#listItem\",\"position\":2,\"name\":\"HTTP Parameter Pollution\",\"previousItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\",\"name\":\"Varutra\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Varutra-Found-e1612984024606.jpg\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/\",\"name\":\"kalpblogger\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"kalpblogger\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#webpage\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/\",\"name\":\"HTTP Parameter Pollution (HPP) and Exploitation Scenario\",\"description\":\"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/HTTP-Parameter-Pollution.png\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#mainImage\",\"width\":1060,\"height\":593,\"caption\":\"HTTP Parameter Pollution\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/http-parameter-pollution\\\/#mainImage\"},\"datePublished\":\"2021-02-19T12:52:09+05:30\",\"dateModified\":\"2023-03-24T12:08:15+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"name\":\"Varutra Consulting\",\"description\":\"Secure your digital world with our Cybersecurity services.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>HTTP Parameter Pollution (HPP) and Exploitation Scenario<\/title>\n\n","aioseo_head_json":{"title":"HTTP Parameter Pollution (HPP) and Exploitation Scenario","description":"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.","canonical_url":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"og:locale":"en_US","og:site_name":"Varutra Consulting","og:type":"article","og:title":"HTTP Parameter Pollution (HPP) and Exploitation Scenario","og:description":"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.","og:url":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/","og:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png","og:image:secure_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png","og:image:width":"1060","og:image:height":"593","article:section":"Web Application Security","article:tag":["http","vulnerability","web application"],"article:published_time":"2021-02-19T07:22:09+00:00","article:modified_time":"2023-03-24T06:38:15+00:00","twitter:card":"summary_large_image","twitter:title":"HTTP Parameter Pollution (HPP) and Exploitation Scenario","twitter:description":"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.","twitter:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png","twitter:label1":"Written by","twitter:data1":"kalpblogger","twitter:label2":"Est. reading time","twitter:data2":"3 minutes","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#article","name":"HTTP Parameter Pollution (HPP) and Exploitation Scenario","headline":"HTTP Parameter Pollution","author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png","width":1060,"height":593,"caption":"HTTP Parameter Pollution"},"datePublished":"2021-02-19T12:52:09+05:30","dateModified":"2023-03-24T12:08:15+05:30","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#webpage"},"isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#webpage"},"articleSection":"Vulnerability Disclosure, Web Application Security, HTTP, Vulnerability, Web Application"},{"@type":"BreadcrumbList","@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/#listItem","position":1,"name":"Home","item":"https:\/\/www.varutra.com\/varutravrt3\/","nextItem":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#listItem"},{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#listItem","position":2,"name":"HTTP Parameter Pollution","previousItem":"https:\/\/www.varutra.com\/varutravrt3\/#listItem"}]},{"@type":"Organization","@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization","name":"Varutra","url":"https:\/\/www.varutra.com\/varutravrt3\/","logo":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/Varutra-Found-e1612984024606.jpg","@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#organizationLogo"},"image":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author","url":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/","name":"kalpblogger","image":{"@type":"ImageObject","@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g","width":96,"height":96,"caption":"kalpblogger"}},{"@type":"WebPage","@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#webpage","url":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/","name":"HTTP Parameter Pollution (HPP) and Exploitation Scenario","description":"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#website"},"breadcrumb":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#breadcrumblist"},"author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"creator":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png","@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#mainImage","width":1060,"height":593,"caption":"HTTP Parameter Pollution"},"primaryImageOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/#mainImage"},"datePublished":"2021-02-19T12:52:09+05:30","dateModified":"2023-03-24T12:08:15+05:30"},{"@type":"WebSite","@id":"https:\/\/www.varutra.com\/varutravrt3\/#website","url":"https:\/\/www.varutra.com\/varutravrt3\/","name":"Varutra Consulting","description":"Secure your digital world with our Cybersecurity services.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"}}]}},"aioseo_meta_data":{"post_id":"8845","title":"HTTP Parameter Pollution&nbsp;(HPP) and Exploitation Scenario","description":"HTTP parameter pollution (HPP) is a hot topic in the field of web application security. Here is exploitation scenario and Countermeasures to prevent from it.","keywords":[],"keyphrases":"{\"focus\":{\"keyphrase\":\"HTTP Parameter Pollution\",\"analysis\":{\"keyphraseInTitle\":{\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInDescription\":{\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"score\":9,\"maxScore\":9,\"error\":0,\"length\":3},\"keyphraseInURL\":{\"score\":5,\"maxScore\":5,\"error\":0},\"keyphraseInIntroduction\":{\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInSubHeadings\":{\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInImageAlt\":{\"score\":9,\"maxScore\":9,\"error\":0}},\"score\":90},\"additional\":[{\"keyphrase\":\"Parameter Pollution\",\"score\":83,\"analysis\":{\"keyphraseInDescription\":{\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"score\":9,\"maxScore\":9,\"error\":0,\"length\":2},\"keyphraseInIntroduction\":{\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInImageAlt\":{\"score\":9,\"maxScore\":9,\"error\":0}}},{\"keyphrase\":\"HTTP Parameter\",\"score\":83,\"analysis\":{\"keyphraseInDescription\":{\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"score\":9,\"maxScore\":9,\"error\":0,\"length\":2},\"keyphraseInIntroduction\":{\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInImageAlt\":{\"score\":9,\"maxScore\":9,\"error\":0}}}]}","primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/02\/HTTP-Parameter-Pollution.png","og_image_width":"1060","og_image_height":"593","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"Web Application Security","og_article_tags":[],"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":"{\"article\":{\"articleType\":\"BlogPosting\"},\"course\":{\"name\":\"\",\"description\":\"\",\"provider\":\"\"},\"faq\":{\"pages\":[]},\"product\":{\"reviews\":[]},\"recipe\":{\"ingredients\":[],\"instructions\":[],\"keywords\":[]},\"software\":{\"reviews\":[],\"operatingSystems\":[]},\"webPage\":{\"webPageType\":\"WebPage\"}}","pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"open_ai":null,"created":"2021-10-27 15:11:54","updated":"2023-03-24 06:42:14"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/\" title=\"Vulnerability Disclosure\">Vulnerability Disclosure<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tHTTP Parameter Pollution\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.varutra.com\/varutravrt3"},{"label":"Vulnerability Disclosure","link":"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/"},{"label":"HTTP Parameter Pollution","link":"https:\/\/www.varutra.com\/varutravrt3\/http-parameter-pollution\/"}],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/8845"}],"collection":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/comments?post=8845"}],"version-history":[{"count":6,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/8845\/revisions"}],"predecessor-version":[{"id":21202,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/8845\/revisions\/21202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media\/8849"}],"wp:attachment":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media?parent=8845"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/categories?post=8845"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/tags?post=8845"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}