daemon-sec-cheatsheet

parameter-pollution.md (13510B)

---

 ---
 title: "Parameter Pollution | JSON Injection"
 section: "Web Pentesting"
 sectionSlug: "pentesting-web"
 sourcePath: "src/pentesting-web/parameter-pollution.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/parameter-pollution.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: false
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # Parameter Pollution | JSON Injection
 
 ## HTTP Parameter Pollution (HPP) Overview
 
 HTTP Parameter Pollution (HPP) is a technique where attackers manipulate HTTP parameters to change the behavior of a web application in unintended ways. This manipulation is done by adding, modifying, or duplicating HTTP parameters. The effect of these manipulations is not directly visible to the user but can significantly alter the application's functionality on the server side, with observable impacts on the client side.
 
 ### Example of HTTP Parameter Pollution (HPP)
 
 A banking application transaction URL:
 
 - **Original URL:** `https://www.victim.com/send/?from=accountA&to=accountB&amount=10000`
 
 By inserting an additional `from` parameter:
 
 - **Manipulated URL:** `https://www.victim.com/send/?from=accountA&to=accountB&amount=10000&from=accountC`
 
 The transaction may be incorrectly charged to `accountC` instead of `accountA`, showcasing the potential of HPP to manipulate transactions or other functionalities such as password resets, 2FA settings, or API key requests.
 
 #### **Technology-Specific Parameter Parsing**
 
 - The way parameters are parsed and prioritized depends on the underlying web technology, affecting how HPP can be exploited.
 - Tools like [Wappalyzer](https://addons.mozilla.org/en-US/firefox/addon/wappalyzer/) help identify these technologies and their parsing behaviors.
 
 ### PHP and HPP Exploitation
 
 **OTP Manipulation Case:**
 
 - **Context:** A login mechanism requiring a One-Time Password (OTP) was exploited.
 - **Method:** By intercepting the OTP request using tools like Burp Suite, attackers duplicated the `email` parameter in the HTTP request.
 - **Outcome:** The OTP, meant for the initial email, was instead sent to the second email address specified in the manipulated request. This flaw allowed unauthorized access by circumventing the intended security measure.
 
 This scenario highlights a critical oversight in the application's backend, which processed the first `email` parameter for OTP generation but used the last for delivery.<sup>[[1]](#references)</sup>
 
 **API Key Manipulation Case:**
 
 - **Scenario:** An application allows users to update their API key through a profile settings page.
 - **Attack Vector:** An attacker discovers that by appending an additional `api_key` parameter to the POST request, they can manipulate the outcome of the API key update function.
 - **Technique:** Utilizing a tool like Burp Suite, the attacker crafts a request that includes two `api_key` parameters: one legitimate and one malicious. The server, processing only the last occurrence, updates the API key to the attacker's provided value.
 - **Result:** The attacker gains control over the victim's API functionality, potentially accessing or modifying private data unauthorizedly.
 
 This example further underscores the necessity for secure parameter handling, especially in features as critical as API key management.<sup>[[1]](#references)</sup>
 
 ### Parameter Parsing: Flask vs. PHP
 
 The way web technologies handle duplicate HTTP parameters varies, affecting their susceptibility to HPP attacks:<sup>[[2]](#references)</sup>
 
 - **Flask:** Adopts the first parameter value encountered, such as `a=1` in a query string `a=1&a=2`, prioritizing the initial instance over subsequent duplicates.
 - **PHP (on Apache HTTP Server):** Contrarily, prioritizes the last parameter value, opting for `a=2` in the given example. This behavior can inadvertently facilitate HPP exploits by honoring the attacker's manipulated parameter over the original.
 
 
 ### HPP Testing Notes (OWASP WSTG)
 
 - HTTP standards do not define how to interpret multiple parameters with the same name, so behavior varies across stacks and components.
 - When testing server-side HPP, duplicate each parameter in query strings or bodies and observe whether the application concatenates values, uses first/last, or errors.
 - For client-side HPP, inject a URL-encoded `&` into a reflected parameter value (e.g., `%26HPP_TEST`) and look for decoded occurrences such as `&HPP_TEST` or `&amp;HPP_TEST` inside generated links or form actions.<sup>[[5]](#references)</sup>
 
 ### Server-Side Parameter Pollution (SSPP) in Internal APIs
 
 Some applications embed user input into server-side requests to internal APIs. If that input is not properly encoded, you can inject or override parameters in the internal request. Test any user input, including query parameters, form fields, headers, and URL path parameters.<sup>[[6]](#references)</sup>
 
 Common probes:
 
 - Add a new parameter with `%26` (URL-encoded `&`).
 - Truncate the downstream query with `%23` (URL-encoded `#`).
 - Override an existing parameter by duplicating it.
 
 Example:
 
 ```http
 GET /userSearch?name=peter%26name=carlos&back=/home
 ```
 
 Potentially results in a server-side request like:
 
 ```http
 GET /users/search?name=peter&name=carlos&publicProfile=true
 ```
 
 ## Parameter pollution by technology
 
 These results were taken from [HTTP Parameter Pollution in 2024](https://medium.com/@0xAwali/http-parameter-pollution-in-2024-32ec1b810f89).<sup>[[3]](#references)</sup>
 
 ### PHP 8.3.11 AND Apache 2.4.62 <a href="#id-9523" id="id-9523"></a>
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281255%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*l_Pf2JNCYhmfAvfk7UTEbQ.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*l_Pf2JNCYhmfAvfk7UTEbQ.jpeg</a></p></figcaption></figure>
 
 1. Ignore anything after %00 in the parameter name .
 2. Handle name\[] as array .
 3. \_GET not meaning GET Method .
 4. Prefer the last parameter .
 
 ### Ruby 3.3.5 and WEBrick 1.8.2
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281257%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*kKxtZ8qEmgTIMS81py5hhg.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*kKxtZ8qEmgTIMS81py5hhg.jpeg</a></p></figcaption></figure>
 
 1. Uses the & and ; delimiters to split parameters .
 2. Not Recognized name\[] .
 3. Prefer the first parameter .
 
 ### Spring MVC 6.0.23 AND Apache Tomcat 10.1.30 <a href="#dd68" id="dd68"></a>
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281258%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*llG22MF1gPTYZYFVCmCiVw.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*llG22MF1gPTYZYFVCmCiVw.jpeg</a></p></figcaption></figure>
 
 1. POST RequestMapping == PostMapping & GET RequestMapping == GetMapping .
 2. POST RequestMapping & PostMapping Recognized name\[] .
 3. Prefer name if name AND name\[] existing .
 4. Concatenate parameters e.g. first,last .
 5. POST RequestMapping & PostMapping Recognized query parameter with Content-Type .
 
 ### **NodeJS** 20.17.0 **AND** Express 4.21.0 <a href="#id-6d72" id="id-6d72"></a>
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281259%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*JzNkLOSW7orcHXswtMHGMA.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*JzNkLOSW7orcHXswtMHGMA.jpeg</a></p></figcaption></figure>
 
 1. Recognized name\[] .
 2. Concatenate parameters e.g. first,last .
 
 ### GO 1.22.7 <a href="#id-63dc" id="id-63dc"></a>
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281260%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*NVvN1N8sL4g_Gi796FzlZA.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*NVvN1N8sL4g_Gi796FzlZA.jpeg</a></p></figcaption></figure>
 
 1. NOT Recognized name\[] .
 2. Prefer the first parameter .
 
 ### Python 3.12.6 AND Werkzeug 3.0.4 AND Flask 3.0.3 <a href="#b853" id="b853"></a>
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281261%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*Se5467PFFjIlmT3O7KNlWQ.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*Se5467PFFjIlmT3O7KNlWQ.jpeg</a></p></figcaption></figure>
 
 1. NOT Recognized name\[] .
 2. Prefer the first parameter .
 
 ### Python 3.12.6 AND Django 4.2.15 <a href="#id-8079" id="id-8079"></a>
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281262%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*rf38VXut5YhAx0ZhUzgT8Q.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*rf38VXut5YhAx0ZhUzgT8Q.jpeg</a></p></figcaption></figure>
 
 1. NOT Recognized name\[] .
 2. Prefer the last parameter .
 
 ### Python 3.12.6 AND Tornado 6.4.1 <a href="#id-2ad8" id="id-2ad8"></a>
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281263%29.png" alt=""><figcaption><p><a href="https://miro.medium.com/v2/resize:fit:1100/format:webp/1*obCn7xahDc296JZccXM2qQ.jpeg">https://miro.medium.com/v2/resize:fit:1100/format:webp/1*obCn7xahDc296JZccXM2qQ.jpeg</a></p></figcaption></figure>
 
 1. NOT Recognized name\[] .
 2. Prefer the last parameter .
 
 ## JSON Injection
 
 [Json Xml Yaml Hacking](/hacktricks/pentesting-web/json-xml-yaml-hacking)
 
 ### Duplicate keys
 
 ```ini
 obj = {"test": "user", "test": "admin"}
 ```
 
 The front-end might believe the first ocurrence while the backend uses the second ocurrence of the key.<sup>[[4]](#references)</sup>
 
 ### Key Collision: Character Truncation and Comments
 
 Certain characters aren't going to be correctly interpreted by the frontend but the backend will interpret them and use those keys, this could be useful to **bypass certain restrictions**:<sup>[[4]](#references)</sup>
 
 ```json
 {"test": 1, "test\[raw \x0d byte]": 2}
 {"test": 1, "test\ud800": 2}
 {"test": 1, "test"": 2}
 {"test": 1, "te\st": 2}
 ```
 
 Note how in these cases the front end might think that `test == 1` and the backend will think that `test == 2`.
 
 This can also by used to bypass value restrictions like:
 
 ```json
 {"role": "administrator\[raw \x0d byte]"}
 {"role":"administrator\ud800"}
 {"role": "administrator""}
 {"role": "admini\strator"}
 ```
 
 ### **Using Comment Truncation**
 
 ```ini
 obj = {"description": "Duplicate with comments", "test": 2, "extra": /*, "test": 1, "extra2": */}
 ```
 
 Here we will use the serializer from each parser to view its respective output.
 
 Serializer 1 (e.g., GoLang's GoJay library) will produce:
 
 - `description = "Duplicate with comments"`
 - `test = 2`
 - `extra = ""`
 
 Serializer 2 (e.g., Java's JSON-iterator library) will produce:
 
 - `description = "Duplicate with comments"`
 - `extra = "/*"`
 - `extra2 = "*/"`
 - `test = 1`
 
 Alternatively, straightforward use of comments can also be effective:
 
 ```ini
 obj = {"description": "Comment support", "test": 1, "extra": "a"/*, "test": 2, "extra2": "b"*/}
 ```
 
 Java’s GSON library:
 
 ```json
 { "description": "Comment support", "test": 1, "extra": "a" }
 ```
 
 Ruby’s simdjson library:
 
 ```json
 { "description": "Comment support", "test": 2, "extra": "a", "extra2": "b" }
 ```
 
 ### **Inconsistent Precedence: Deserialization vs. Serialization**
 
 ```ini
 obj = {"test": 1, "test": 2}
 
 obj["test"] // 1
 obj.toString() // {"test": 2}
 ```
 
 ### Float and Integer
 
 The number
 
 ```text
 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
 ```
 
 can be decoded to multiple representations, including:
 
 ```text
 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
 9.999999999999999e95
 1E+96
 0
 9223372036854775807
 ```
 
 These differing numeric representations can create parser inconsistencies.<sup>[[4]](#references)</sup>
 
 ## References
 
 - [1] [HTTP Parameter Pollution. It's Contaminated](https://medium.com/@shahjerry33/http-parameter-pollution-its-contaminated-85edc0805654)
 - [2] [Writeup for Under Construction - Google CTF 2023](https://github.com/google/google-ctf/tree/main/2023/quals/web-under-construction/solution)
 - [3] [HTTP Parameter Pollution in 2024](https://medium.com/@0xAwali/http-parameter-pollution-in-2024-32ec1b810f89)
 - [4] [JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities)
 - [5] [Testing for HTTP Parameter Pollution - OWASP WSTG](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution)
 - [6] [Server-side parameter pollution - PortSwigger](https://portswigger.net/web-security/api-testing/server-side-parameter-pollution)