HTTP Verb Tampering — Bypassing Security Filters

The more common verb tampering variant. Security filters that only inspect parameters from a specific HTTP method (e.g., $_POST['parameter']) can be bypassed by switching the request to a method the filter ignores.

Identify

Look for a security filter that blocks certain input:

• Submit a payload with special characters (e.g., test;) via the normal method
• If the app returns a “Malicious Request Denied” style message, a filter is in place
• The filter is the target — the goal is to reach the underlying vulnerability it is protecting

Exploit

Step 1 — switch request method

Intercept the request in Burp Suite and change the method (e.g., GET → POST, or POST → GET). If the filter only checks one method’s parameter source, the alternate method carries the payload past it.

• No “Malicious Request Denied” response = filter bypassed

Step 2 — confirm the underlying vulnerability

Bypassing the filter alone is not enough — confirm the actual vulnerability is exploitable. For a command injection sink:

1. Submit a payload that creates two files: file1; touch file2;
2. Change the request method to bypass the filter
3. Check whether both file1 and file2 appear — if they do, the command executed

Why this works

The filter inspects one parameter source (e.g., $_POST) but the underlying function uses a broader source (e.g., $_REQUEST). Switching methods delivers the payload through an unchecked channel while the function still processes it.

Key point

HTTP Verb Tampering can turn a well-filtered vulnerability into an exploitable one. A web application may appear secure against injection when tested normally, but if the filter does not cover all HTTP methods, a simple method switch exposes the underlying flaw.