HTTP Parameter Pollution (HPP) vulnerabilities allow attackers to exploit web applications by manipulating the query parameters in the URL and requested body which causes the Cross Site Scripting or Privilege Escalation or bypass Authorization.

HTTP Parameter Pollution affects both Server side as well as Client Side components as it is injecting additional/multiple parameters (i.e. GET/POST/Cookie) to the links, tags, attributes.

HTTP Parameter Pollution attacks may add parameters or overwrite the existing parameters variables by injecting query string delimiters into existing HTTP parameters.

If exploited it can be launched from Client Side or server side attacks.

Modal:

• First we need one vulnerable web application. In this tutorial i am working with bWAPP web application. If you need bWAPP you can download here https://sourceforge.net/projects/bwapp/ .

• HTTP Parameter Pollution is possible most of the time in URL based.

• Do this, you just submit the form in web page, After submit see the URL. For example current URL is “http://localhost/work/bWAPP_latest/bWAPP/hpp-3.php?movie=9&name=vegabird&action=vote”. Here you got 3 parameters.Now you copy the same URL and change it like  “http://localhost/work/bWAPP_latest/bWAPP/hpp-3.php?movie=9&name=vegabird&action=vote&movie=2”  then past it your URL section and run it. if here possible of HTTP Parameter Pollution then it will work.
  

Prevention of HTTP Parameter Pollution:

• Keep in mind that your web application validates all forms, headers, cookie fields, hidden fields, and parameters, i.e. input validation.

• Accept parameters only where they are supposed to be supplied.

• HTTP Parameter Pollution server side, it’s always important to use URL encoding whenever you do GET/POST HTTP requests to an HTTP back-end.

• From the client-side point of view, use URL encoding whenever you are going to include user-supplied content within links, etc.