Skip to content
Attacking parameter names
portswigger.net | blog | #sql-injection | #web-security | #penetration-testing | #parameter-names | #input-validation
Summary
Attacking parameter names instead of values can find bugs that value fuzzing misses, since apps validate values but not names. The post demos SQL injection via arbitrary query string parameters.
- Published
- Collected