Authentication & Access Control

Parameter Tampering

Intercept and modify what your browser sends before it reaches the server. Change prices, quantities, and hidden fields to expose how much trust applications blindly place in the client.

Beginner45 min8 lessons1 hands-on

Start free →I have an account

First lesson free. The full module is part of Pro.

You'll be able to

✓Identify hidden and trusted parameters in requests
✓Modify prices, quantities, roles, and IDs to change application behaviour
✓Find parameters that are reflected in state-changing responses
✓Use Burp Intruder to fuzz parameter values at scale

Lessons

1The Server Trusts You — That's the Problem
2What Your Browser is Actually Sending
3Using the Interceptor — A Walkthrough
4Activity 1 — Change the Price
5Your Turn: Rewrite the PriceHANDS-ON
6Activity 2 — Change the Quantity
7Activity 3 — Hidden Fields
8Module quiz

Start free →