Testing for HTTP Parameter Pollution (HPP)
In this recipe, we are going to go over HPP, and you will learn that by polluting a parameter, an attacker could take advantage of creating an account and take over another user’s account for their use.
Getting ready
To prepare for this recipe, please start ZAP and OWASP Juice Shop. Make sure that ZAP intercepts traffic at the OWASP Juice Shop application home page.
How to do it…
In this recipe, we’ll lead you through the steps on how to conduct HPP in OWASP Juice Shop. We are going to pollute the email field by adding a second value, which will allow the account creation process to establish an account with the attacker’s email in place of the victim’s email.
The following steps guide you through this process:
- Open ZAP and enable interception on ZAP by clicking Set break on all requests and responses, which will turn from green to red when enabled. See Figure 6.6:
...
