> For the complete documentation index, see [llms.txt](https://kathan19.gitbook.io/howtohunt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kathan19.gitbook.io/howtohunt/parameter-pollution/parameter_pollution_in_social_sharing_buttons.md).

# Parameter Pollution In Social Sharing Buttons

Hi Guys, Though it is not severe bug.But still some organizations take this seriously.

## Steps :

```
1.Browse through your target.
  say https://target.com
2.Find a article or blog present on target website which must have a link to share that blog on different social networks such as
  Facebook,Twitter etc.
3.Let's say we got and article with url:
  https://taget.com/how-to-hunt 
  then just appened it with payload ?&u=https://attacker.com/vaya&text=another_site:https://attacker.com/vaya
  so our url will become 
  https://taget.com/how-to-hunt?&u=https://attacker.com/vaya&text=another_site:https://attacker.com/vaya
4.Now hit enter with the abover url and just click on share with social media.
  Just observe the content if it is including our payload i.e. https://attacker.com
  Then it is vulnerable or else try next target.
```

## References:

* <https://hackerone.com/reports/105953>
* Google

## Author

* [KenAdams000](https://twitter.com/KenAdams000)