CODEWITHSUNDEEP
url-parameters
ashish singh
ashish singh

Reputation: 23

HTTP parameter pollution URL encoding bypass

as in this section here they gave the mitigation by encoding the input as url encoding, is there any way to bypass such mitigation ??

Upvotes: 1

Views: 439

Answers (1)

Karan Shishoo
Karan Shishoo

Reputation: 2801

If correct URL encoding is applied and only the needed fields are considered and validated there is no method of bypassing such a mitigation using HTTP parameter pollution.

[The HPP vulnerability is based on the fact that proper URL parameter validation and verification is not implemented and that the backend accepts and uses any input if applicable, instead of filtering and accepting only specific inputs needed from a request and ignoring the rest]

Upvotes: 1

Related Questions