Parameter Pollution

Parameter Pollution Testing

This skill helps you identify and exploit HTTP Parameter Pollution (HPP) and JSON injection vulnerabilities in web applications.

Quick Start

1. Identify the target technology (PHP, Flask, Django, Node.js, etc.)
2. Test parameter parsing behavior using the technology-specific guide below
3. Apply HPP techniques based on how the target handles duplicates
4. Test for JSON injection if the application uses JSON APIs

HTTP Parameter Pollution (HPP) Testing

What is HPP?

HTTP Parameter Pollution occurs when an application processes duplicate HTTP parameters inconsistently. By adding, modifying, or duplicating parameters, you can manipulate application behavior.

Example:

Original:  https://victim.com/send/?from=accountA&to=accountB&amount=10000
Polluted:  https://victim.com/send/?from=accountA&to=accountB&amount=10000&from=accountC

The server might use accountC instead of accountA depending on its parameter parsing logic.

Testing Methodology

Step 1: Identify the Technology

Use tools like Wappalyzer or inspect response headers to determine:

• Web framework (Flask, Django, Spring, Express, etc.)
• Server (Apache, Nginx, Tomcat, etc.)
• Language (PHP, Python, Node.js, Go, Ruby)

Step 2: Test Parameter Parsing Behavior

Send requests with duplicate parameters and observe which value the application uses:

# Test with curl
curl "https://target.com/api?param=value1&param=value2"

# Test with Burp Suite or similar proxy
GET /api?name=test1&name=test2 HTTP/1.1
Host: target.com

Step 3: Apply Technology-Specific Techniques

Refer to the Technology Reference section below for how each stack handles duplicates.

Common HPP Attack Vectors

Server-Side Parameter Pollution (SSPP)

Some applications embed user input into internal API requests. Test for SSPP by:

1. Adding parameters with %26 (URL-encoded &)
2. Truncating queries with %23 (URL-encoded #)
3. Overriding existing parameters by duplicating them

Example:

GET /userSearch?name=peter%26name=carlos&back=/home

May result in internal request:

GET /users/search?name=peter&name=carlos&publicProfile=true

Client-Side HPP Testing

Inject URL-encoded & into reflected parameters:

# Inject %26 (URL-encoded &)
curl "https://target.com/search?q=test%26HPP_TEST"

Look for decoded occurrences in the response:

• &HPP_TEST - parameter was decoded and could be exploited
• &HPP_TEST - properly escaped, likely safe

Technology Reference

PHP (Apache)

Exploitation tip: Place malicious value as the last duplicate parameter.

Python Flask / Werkzeug

Exploitation tip: Place malicious value as the first duplicate parameter.

Python Django

Python Tornado

Node.js Express

Exploitation tip: Use array syntax or expect comma-separated values.

Go (Standard Library)

Ruby WEBrick

Spring MVC / Tomcat

JSON Injection Testing

Duplicate Keys

Different JSON parsers handle duplicate keys differently:

{"test": "user", "test": "admin"}

• Frontend might use first value (user)
• Backend might use last value (admin)

This inconsistency can be exploited to bypass validation.

Key Collision Techniques

Use special characters to create key collisions:

{"test": 1, "test[raw \x0d byte]": 2}
{"test": 1, "test\ud800": 2}
{"test": 1, "test"": 2}
{"test": 1, "te\st": 2}

The frontend may see test == 1 while the backend sees test == 2.

Bypass Value Restrictions

{"role": "administrator[raw \x0d byte]"}
{"role": "administrator\ud800"}
{"role": "administrator""}
{"role": "admini\strator"}

Comment Truncation

Some JSON parsers support comments:

{"test": 1, "extra": "a"/*, "test": 2, "extra2": "b"*/}

Java GSON:

{"test": 1, "extra": "a"}

Ruby simdjson:

{"test": 2, "extra": "a", "extra2": "b"}

Float/Integer Precision Issues

Very large numbers may be decoded differently:

{"id": 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999}

May become:

• 9.999999999999999e95
• 1E+96
• 0
• 9223372036854775807 (max int64)

Practical Testing Checklist

• Identify target technology stack
• Test duplicate parameter handling (first vs last vs concatenate)
• Test array syntax (name[])
• Test URL-encoded parameter injection (%26)
• Test query truncation (%23)
• Test client-side HPP with reflected parameters
• Test JSON duplicate keys if API uses JSON
• Test JSON comment injection
• Test JSON key collision with special characters
• Test large number precision issues
• Document findings and affected endpoints

Tools

• Burp Suite - Intercept and modify HTTP requests
• Wappalyzer - Identify technology stack
• curl - Quick parameter testing
• Custom scripts - See scripts/ directory

References

• OWASP WSTG - HPP Testing
• PortSwigger - Server-Side Parameter Pollution
• Bishop Fox - JSON Interoperability Vulnerabilities
• HTTP Parameter Pollution in 2024