Popular Http Parameter Pollution

Hi.baidu.com/80sec

Speaking of Http Parameter Pollution, this problem will make me very angry, because such a simple problem will be very complicated for some people, and even ignore the base problem of passing URL parameters, the following examples are provided:

1. For normal search, pass a parameter Q and search for the keyword xss.

Http://www.google.cn/search? Q = xss

2. Input two parameters, Q, and the content is merged.

Http://www.google.cn/search? Q = xss & q = xss

3. After the & encoding between the two parameters Q, the search keyword xss & q = xss

Http://www.google.cn/search? Q = xss % 26q = xss

4. encode & q = xss and search for the keyword xss & q = xss

Http://www.google.cn/search? Q = xss % 26q % 3 Dxss

 

Let's talk about 3, 4 first. This should be common sense. & the encoded part of the content will become the content of the query parameter when no query operator is found.

As for 2, GOOGLE has the risk of Http Parameter Pollution!

What does Http Parameter Pollution mean? I don't have to worry about it. Let's go to the OWASP documentation. Security is the foundation. Although WEB security is simple, security issues are also serious. We need to take them seriously.