> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/api-testing/lab-5.md).

# Lab 5

`%2f` = `/` URL encoded

### Testing for server-side parameter pollution in REST paths

A RESTful API may place parameter names and values in the URL path, rather than the query string. For example, consider the following path:

`/api/users/123`

The URL path might be broken down as follows:

* `/api` is the root API endpoint.
* `/users` represents a resource, in this case `users`.
* `/123`represents a parameter, here an identifier for the specific user.

Consider an application that enables you to edit user profiles based on their username. Requests are sent to the following endpoint:

`GET /edit_profile.php?name=peter`

This results in the following server-side request:

`GET /api/private/users/peter`

{% hint style="info" %}
Since REST APIs take a HTTP link this type instead of injecting a query string with URL-Encoded, we just send the payload in the URL, which then turns into a server-side parameter pollution as it translate it back to file paths  
{% endhint %}

<figure><img src="/files/vIHTQJO2Wto6gxHAAl3W" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/zRQWq1ElNv3frjH8FQfs" alt=""><figcaption></figcaption></figure>

#### The rule of thumb

> Inject where the server reads your input from

If the server reads `name` from the query string → inject there. If the server reads a value and puts it in a URL path → inject path traversal there.

{% hint style="info" %}
`\"` = escaped quote = lets you break out of a JSON string value when your input is already being sent as JSON. This allows you to do `peter\",\"access_level\":\"administrator`
{% endhint %}