What exactly are Hidden HTTP Parameters?

Question

I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.

Example : https://blog.yeswehack.com/yeswerhackers/parameter-discovery-quick-guide-to-start/

But what do they mean by hidden?
I could think of 2 scenarios:

1. The parameter is not visible in the GUI (the browser) but then can easily be viewed by using a proxy such as Burp or Zap, which makes them not so hidden.
2. The backend developer mistakenly created a parameter 'xyz', which the hacker 'guessed' (used regex or got lucky) sent a GET or a POST request with that parameter, which then got executed in the backend. But for this to work, 'xyz' would actually have to parse that request, so that the payload gets executed. But why would a developer create a parameter like this in the first place, if it doesn't serve a real purpose.

Or is it an entirely different scenario that I can't think of?

Answer 1

There is no such thing as "hidden HTTP parameters". You mean probably the HTML <input> elements of type hidden.

Basically, there are 2 ways how browser creates a request with parameters.

1. Using HTML element <form>

In this scenario a web page contains a <form>. This contains <input> elements like text fields, radio buttons, check boxes, buttons. When user clicks on an <input> element of type submit, browser collects all <input> elements in the current <form> and adds them to the target URL, which is defined in the action attribute of the <form> element (assuming we use application/x-www-form-urlencoded). As a part of URL, they are called request parameters.

For instance, if there is a text <input> element with ID "name" and user entered text "John", the browser will append following to the target URL: ...?name=John or, if there are already other elements: ...&name=John

Some of <input> elements can be hidden. See details here. They behave similar to text fields, i.e. similar to <input> elements of type text, but browser does not display them as fields. That's why they are called hidden. Nevertheless, when user clicks on an <input> element of type submit, not only visible fields, but also hidden fields will be added to the target URL.

2. Using AJAX

In this case the web page may or may not contain <form> element. Usually, there is no <input> element of type submit. Instead, there are JavaScript functions that handle particular events, like clicking on a button that should submit the request. In such case, when user clicked e.g. on OK button, it can trigger a function that programmatically adds parameters to the target URL. These parameters can be be provided by different sources, not only by HTML <input> elements of type hidden, but also by JavaScript variables and JavaScript functions. In such case we usually call parameters hidden, if user cannot change them via interaction with the web page, e.g. via entering text or via clicking on some buttons.

Both cases have similarity: Hidden parameter is a parameter that user cannot change via interaction with the web page.

Answer 2

It looks like they are using a pre-determined list of words such as to look for a response.

Arjun can find query parameters for URL endpoints. If you don't get what that means, it's okay, read along.

Web applications use parameters (or queries) to accept user input, take the following example into consideration

http://api.example.com/v1/userinfo?id=751634589

This URL seems to load user information for a specific user id, but what if there exists a parameter named admin which when set to True makes the endpoint provide more information about the user?

You can change this word list.

If you are worried about it for your websites, there are more comprehensive tools for that. I use OWASP.

Preventative measures

• Don't use parameters unless necessary and for trivial things.
• Use made-up words for params.
• Instead, use the session and encrypt sensitive variables.
• For admin mode, for instance, I have used a temporary random token on the session and also saved it in a local table. And I check it on every page/refresh. And it expires after a few minutes.

You are Questioning why a developer would create such a parameter. Only the developer would know this. This is asking for opinions. The issue isn't why these were created but that they may exist.