HTTP Parameter Pollution - It’s Contaminated Again

  1. Unreserved: a-z, A-Z, 0–9 and _ . ! ~ * ‘ ( )
  2. Reserved: ; / ? : @ & = + $ ,
  1. We added the email in invite member functionality
Invite Member
Invite Member
Invite Member - Error
Intercepted Request - Invite Member
Polluting the parameter
Response - Success
Inbox - 3 Emails
Intercepted Request - Invite email
200 Emails
Inbox Flooded - 200 Emails
Improper Validation Flow

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Jerry Shah (Jerry)

Jerry Shah (Jerry)

|Penetration Tester| |Hack The Box| |Digital Forensics| |Malware Analysis|