Parameter Tampering: Special Characters

Processing of user-supplied input without proper validation can enable an attacker to gain unauthorized access to server resources, extract information from a database, or execute arbitrary operating-system level commands.

Exposure to parameter tampering attacks result from improper validation of characters accepted by the application. Whenever a parameter is passed into a dynamically generated web page, it must be assumed that the data is incorrectly formatted. Insufficient validation of parameters can enable attackers to severely compromise the application resources as well its operation. The following forms of input when processed without proper validation can lead to disclosure of sensitive information or expose the application to arbitrary command execution.

Query String: Web applications often use query strings as a simple method of passing data from the client and the server. Query strings are a way to add data calls to a hyperlink, and then retrieve that information on the linked page when it is displayed. By manipulating query strings, an attacker can easily steal information from a database, learn details about the architecture of your web application, or possibly execute commands on your web server.

Post data: Because manipulating a query string is as easy as typing text in the address bar of a browser, many web applications rely on the POST method coupled with the use of forms rather than GET to pass data between pages. Even if the POST data is not directly visible in the browser, failure to cleanse the information received through the POST parameters can enable an attacker to conduct the same attacks as done with the QUERY parameters.

Headers: Both HTTP requests and responses use headers to deliver information about the HTTP message. Validate all HTTP headers because headers such as the "referrer" or "user-agent" are often logged to a database for traffic statistics. Failure to validate this information can enable attackers to inject malicious data into the logs and execute arbitrary commands.

Cookies: Many web applications use cookies to save information (for example, user ID's and timestamps) on the client's machine. By tampering with these values, or poisoning the cookie, malicious users can gain access to the accounts and information of other users. Furthermore, attackers can also steal a user's cookie and gain direct access to the user's account and bypass authentication.