Parameter Tampering

What is Parameter Tampering?

Parameter tampering is a form of Web-based attack in which certain parameters in the Uniform Resource Locator (URL) or Web page form field data entered by a user are changed without that user's authorization. This points the browser to a link, page or site other than the one the user intends (although it may look exactly the same to the casual observer).

Parameter tampering can be employed by criminals and identity thieves to surreptitiously obtain personal or business information about the user. Countermeasures specific to the prevention of parameter tampering involve the validation of all parameters to ensure that they conform to standards concerning minimum and maximum allowable length, allowable numeric range, allowable character sequences and patterns, whether or not the parameter is actually required to conduct the transaction in question, and whether or not null is allowed.

Parameter Tampering Example

Here is a common URL in a web application.

      http://www.yourbank.com/activity/detail?account=51846636433522240425
      

A malicious user could modifies account parameter trying to view another person's account details.

Tampering a hidden field parameter is another common attack.

    <input type="hidden" id="product-1" name="cost" value="70.00">
      

Another malicious user could modify value parameter in a e-commerce web page and take advantage of this attack.