# Exploiting Server-Side Parameter Pollution in a Query String - PortSwigger Lab Walkthrough

### Introduction

In this post, I’ll walk through the PortSwigger lab on exploiting **Server-Side Parameter Pollution (SSPP)** in a query string to escalate privileges and reset the admin password. This lab is a great way to understand how duplicate parameters in HTTP requests can be abused by attackers.

### Key Concepts:

1. **Parameter Pollution:** Occurs when multiple parameters with the same name are sent in a request, and the server parses them incorrectly or inconsistently.
    
2. **SSPP in Query Strings:** Abusing the application’s logic by appending multiple identical query parameters to manipulate behavior.
    

### Step-by-Step Walkthrough:

**Step 1: Enumerate the Password Reset Function**

1. Send a GET request to / `forgot-password?username=administrator`.
    
2. This reveals a **POST** endpoint to reset the password: `/forgot-password`.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357465457/ac617600-6918-48ef-9986-059d80fb094e.png align="center")
    

**Step 2: Send POST Request**

1. Send a request like:
    
2. You’ll receive a message: **Missing field: token.**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357506280/bc61d16a-438a-4be6-b5f1-939883c7c502.png align="center")
    

**Step 3: Add a** `field` **Parameter**

Add the following in the query string:

`/forgot-password?field=email`

You’ll get a **Field not specified** error.

Now try:

`/forgot-password?field=email&field=username`

You’ve now polluted the parameter.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357568768/48d707c0-43ee-4a16-937a-806f0279b5eb.png align="center")

**Step 4: Burp Suite to Add Payload**

Use Burp Suite Repeater to intercept the request:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357675607/e87ea863-d706-45cd-b3fa-178df6766ed0.png align="center")

**Step 5: Trigger Password Reset**

This triggers the logic needed to reset the password. Now use **Payload configuration** in Burp Intruder to brute-force the password reset form if needed.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357712957/8747be3e-369e-4a3f-aeb2-01a5fc828d48.png align="center")

**Step 6: Change the Field to** `email` **in Query**

Update query string to:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357739175/ccce1cd6-a547-43a7-a61e-835a8955a36d.png align="center")

1. In the **Repeater** tab, change the value of the `field` parameter from `email` to `reset_token`:
    
    `username=administrator%26field=reset_token%23`
    
    Send the request. Notice that this returns a password reset token. Make a note of this.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357840189/41724837-11eb-44a0-8fd4-88ff4e6f7130.png align="center")
    
2. In Burp's browser, enter the password reset endpoint in the address bar. Add your password reset token as the value of the `reset_token` parameter . For example:
    
    `/forgot-password?reset_token=123456789`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744357864331/80e6a425-a6fb-46dc-8da0-a0f0d5b74396.png align="center")
    
    3. Now you can log into the administrator page and we can access the admin panel and we can delete the user **carlos**.
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1744358002025/3fc078a6-216b-4397-bcb2-3a08c2625b4d.png align="center")
        

### Conclusion

This lab demonstrates how SSPP vulnerabilities can be leveraged to manipulate logic in web applications. Understanding how servers parse parameters helps in identifying potential weaknesses. Always validate and sanitize input server-side and avoid relying on query parameter names to enforce logic.