Parameter Manipulation
Manipulating the data sent between the browser and the web application to an attackers advantage, has long been a simple but effective way to make applications do things in a way the user often shouldn't be able to. In a badly designed and developed web application, malicious users can modify things like prices in web carts, session tokens or values stored in cookies and even HTTP headers.
No data sent to the browser can be relied upon to stay the same unless cryptographically protected. Parameter tampering can often be done with;
- Cookies
- Form Fields
- URL Query Strings
- HTTP Headers
| Informational
Client-Side Comments
Debug Commands
Error Codes
File/Application Enumeration
Input Validation
Client Side Validation
Cross-Site Scripting
Direct OS Command
Direct SQL Commands
Directory Traversal
Meta Characters
Null Characters
URL Encoded Input
Session Management
Session Hi-Jacking
Session Replay
Parameter Manipulation
Cookie Manipulation
Form Field Manipulation
HTTP Header Manipulation
URL Manipulation
Mis-Configurations
Default Accounts
Vendor Patches
Privacy Violations
Browser Cache
Browser History
| 
