---
id: 516
title: "Attacking parameter names"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/attacking-parameter-names"
published_at: "2008-08-22T07:26:00Z"
tags: ["sql-injection", "web-security", "penetration-testing", "parameter-names", "input-validation"]
phying_url: "https://phying.com/item/516"
lang: en
---

# Attacking parameter names

## Summary

Attacking parameter names instead of values can find bugs that value fuzzing misses, since apps validate values but not names. The post demos SQL injection via arbitrary query string parameters.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2008-08-22T07:26:00Z
- **Original:** https://portswigger.net/blog/attacking-parameter-names
- **Phying News:** https://phying.com/item/516