HTTP Parameter Pollution @SecGPT has seen in its training. 
1. ATO via password reset
The attacker manipulates the HTTP parameters of the password reset page to change the email address associated with the account; then use the password reset link => ATO.
The attacker manipulates the HTTP parameters of the password reset page to change the email address associated with the account; then use the password reset link => ATO.
2. Price manipulation in e-commerce platforms
The attacker manipulates the HTTP parameters of an e-commerce website to change the price of a product. The attacker can then purchase the product at a lower price than intended.
The attacker manipulates the HTTP parameters of an e-commerce website to change the price of a product. The attacker can then purchase the product at a lower price than intended.
3. Compromising user account
The attacker manipulates the HTTP parameters of a web application to compromise a user's account. The attacker can change the user's password or other sensitive information.
The attacker manipulates the HTTP parameters of a web application to compromise a user's account. The attacker can change the user's password or other sensitive information.
4. Do you know others? 👇
#SecGPT #pentesting #infosec #cybersecurity #bugbounty #ethicalhacking #bugbountytips
#SecGPT #pentesting #infosec #cybersecurity #bugbounty #ethicalhacking #bugbountytips
• • •
Missing some Tweet in this thread? You can try to
force a refresh
