Which attack manipulates parameters exchanged between client and server to modify application data?

Which attack manipulates parameters exchanged between client and server to modify application data?

• A. Unvalidated Inputs
• B. Parameter/Form Tampering
• C. Improper Error Handling
• D. Insufficient Transport Layer Protection

Answer: (B)

Parameter/Form tampering involves altering values exchanged between the client and the server to change how the application behaves or what data it processes. An attacker can modify data in the request—such as URL query strings, POST bodies, hidden form fields, or cookies—and the server may accept those changes as if they came from a legitimate user. This is why the application must not trust client-provided data and should enforce server-side validation and integrity checks. This attack is distinct from simply lacking input validation, which is a broader weakness that can enable many issues; it’s specifically about manipulating the data that the app receives in order to influence its behavior. It’s also not primarily about error handling or about a weak transport layer; while proper error handling and TLS matter, the scenario described relies on tampering with the data itself rather than just exposing errors or eavesdropping on traffic.

Parameter/Form tampering involves altering values exchanged between the client and the server to change how the application behaves or what data it processes. An attacker can modify data in the request—such as URL query strings, POST bodies, hidden form fields, or cookies—and the server may accept those changes as if they came from a legitimate user. This is why the application must not trust client-provided data and should enforce server-side validation and integrity checks.

This attack is distinct from simply lacking input validation, which is a broader weakness that can enable many issues; it’s specifically about manipulating the data that the app receives in order to influence its behavior. It’s also not primarily about error handling or about a weak transport layer; while proper error handling and TLS matter, the scenario described relies on tampering with the data itself rather than just exposing errors or eavesdropping on traffic.