Skip to content

lab8.md

Latest commit

 

History

History
103 lines (67 loc) · 4.26 KB

lab8.md

File metadata and controls

103 lines (67 loc) · 4.26 KB
Raw

Practice Lab 8 - Parameter Pollution

Objective: In this lab, students will investigate HTTP Parameter Pollution (HPP), a web application vulnerability where attackers exploit how multiple identical parameters in URLs are processed. This attack could manipulate backend processing logic, enabling attackers to change query results, bypass security mechanisms, or even perform privilege escalation.

Background / Scenario:

HTTP Parameter Pollution occurs when an attacker injects multiple HTTP parameters with the same name, potentially altering the intended behavior of the application. By doing this, attackers can override, delete, or bypass certain parameters or inject unexpected values into requests.

Required Resources:

  • Internet access
  • Web browser
  • A vulnerable web application or lab environment, such as DVWA or OWASP Juice Shop, is recommended for practical exploration.

Instructions:

Part 1: Identifying Potential Parameter Pollution Vulnerabilities

Question 1:
You are investigating the security of a web application and want to determine if it is vulnerable to HTTP Parameter Pollution (HPP) attacks. Which URL would you attempt to exploit first?

  • A) https://store.h4cker.org/customers/
  • B) https://store.h4cker.org/?search=battery&results=30&search=knives
  • C) https://store.h4cker.org/?search=laptops&type=macbook&chip=M2&screen=15
  • D) https://store.h4cker.org/?search=knives

Part 2: Crafting Parameter Pollution Exploits

  1. Experiment with Parameter Injection:
    Try injecting additional parameters into the URL. Example:
    https://store.h4cker.org/?search=knives&search=batteries
    • What happens when you submit multiple search parameters?
    • How does the web application handle the conflicting parameters?

Part 3: Testing with an HPP Scenario

  1. Craft a query that might bypass application logic:
    Imagine a shopping website with a query such as:
    https://store.h4cker.org/?discount=10&discount=50&price=100
    • What price might be displayed in this case if the website doesn't properly handle parameter pollution?
    • How could attackers exploit this in a real-world scenario?

Part 4: Analyzing Responses to HPP Attacks

  1. Test Different Response Behavior:
    Use tools like Burp Suite or Postman to modify request parameters and analyze how the server responds.
    • Which parameter values are accepted or overridden by the server when you send multiple identical parameters?
    • How does the backend handle parameter conflicts: does it accept the first, last, or concatenate the values?

Part 5: Preventing HTTP Parameter Pollution

  1. Research Mitigation Techniques:
    Conduct online research or refer to secure coding guidelines for preventing HTTP parameter pollution.
    • How can web developers secure their applications against HPP attacks?
    • What techniques can be employed to ensure the proper handling of query parameters?

Reflection Questions

  • Question 2: What are the common methods used by web applications to process multiple parameters with the same name?

    • A) Use the first parameter value
    • B) Use the last parameter value
    • C) Concatenate all parameter values
    • D) Randomly select a value from the parameters
    • E) All of the above

  • Question 3: Why might an attacker be interested in exploiting HTTP Parameter Pollution on a shopping website?

  • Question 4: How could HTTP Parameter Pollution lead to security issues such as privilege escalation or access control bypass?

  • Question 5: How can the use of URL encoding help prevent parameter pollution exploits?

Bonus Challenge

Create your own HPP exploit against a vulnerable application (such as OWASP Juice Shop or DVWA). Submit a short report detailing:

  1. The URL and request you used to exploit the vulnerability.
  2. The application’s response to your attack.
  3. Possible consequences of the vulnerability in a real-world environment.
  4. Suggested remediation steps.

Lab Conclusion: By completing this lab, students should have a clear understanding of HTTP Parameter Pollution vulnerabilities, how they can be exploited, and how to mitigate them in web applications.