# Exploiting server-side parameter pollution in a query string ## Description To solve the lab, log in as the `administrator` and delete `carlos`. ## Solution

In this case we don't know any credential account, so we can try to login with an example of credential like as 'administrator' and 'password'. Of course the credentials are wrong, so we can use the forgot password (`/forgot-password)`function to try to retrieve credentials

Here, we can start the procedure to retrieve 'administrator' credentials, trying others account like as: 'alex' we receive an error regarding account don't found.

System send to the administrator's email the code/link to change password, but the first part of email is censured. Analyzing request with Burp there's an interesting file javascript: /static/js/forgotPassword.js that contain a function to reset token:

Pass to check `/login` page, and try to check methods allowed via OPTION method:

the method is not allowed, but permit us to discover that GET and POST methods are allowed. We can try to insert an username that's not exists (alex) and another one that exists (administrator), seeing a different response:

So, we can proceed using Burp Intruder fuzzing username parameter and finding that field payload exists:

Adding field as parameter and his value, we're able to extract username value:

While, doing the same for field=password we obtain a 400 status code:

Remember the javascript file, there's this interesting path in which is inserted a resetToken value:

So, doing a POST request in which we assigned reset\_token to field parameter we can extract the relative reset token as response:

and doing GET /forgot-password?reset\_token=y8xhpee8hgln52pc9fbj418fu0nxavev we can reset correctly the password changing it:

Now we're administrator user and going to Admin panel is possible to delete Carlos user solving the lab.

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://dev-angelist.gitbook.io/writeups-and-walkthroughs/portswigger-web-security-academy/api-testing/server-side-parameter-pollution/exploiting-server-side-parameter-pollution-in-a-query-string.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.