Be part of the Intuity Army
Send your application to careers@intuity.it.
By submitting your application, you confirm that you have read the privacy policy regarding the processing of your personal data for recruitment purposes.
On May 14th @ OWASP Appsec Poland 2009, me & Luca Carettoni presented a new attack category called Http Parameter Pollution (HPP).
HPP attacks can be defined as the feasibility to override or add HTTP GET/POST parameters by injecting query string delimiters.
It affects a building block of all web technologies thus server-side and client-side attacks exist.
Exploiting HPP vulnerabilities, it may be possible to:
- Override existing hardcoded HTTP parameters.
- Modify the application behaviors.
- Access and, potentially exploit, uncontrollable variables.
- Bypass input validation checkpoints and WAFs rules.
Just to whet your appetite, I can anticipate that by researching real world HPP vulnerabilities, we found issues on some Google Search Appliance front-end scripts, Ask.com, Yahoo! Mail Classic and several other products.
You can download the slides of the talk here (pdf) or browse it on Slideshare.
Also, we’ll soon release a whitepaper in order to clarify all details about HPP.
As last news, in a few days the video of “Yahoo! Classic Mail” exploitation of Client Side HPP will be available on this blog.
So…stay tuned!