HTTP Parameter Pollution

[luantranminh]

https://www.youtube.com/watch?v=QVZBl8yxVX0

What is HTTP Parameter Pollution?

HTTP Parameter Pollution (HPP) is an attack evasion technique that allows an attacker to craft an HTTP request to manipulate or retrieve hidden information.

A web server may override parameters, choose the first occurrence or the last occurrence, or combine them in the case of duplicates. This opens a gate to inject malicious parameters.

Example of HTTP Parameter Pollution

Mitigating HTTP Parameter Pollution Attacks

• Strict Parameter Validation
• Single Parameter Instances
• Input Sanitization
• Use of Security Headers : using security headers like Content Security Policy to mitigate the risk of code injection attacks Security Headers #174