ATTACK HTTP Parameter Pollution Vulnerabilities
ATTACKHTTP ParameterPollution Vulnerabilitiesin Web ApplicationsIs your web application protected against HTTP ParameterPollution? A new class of injection vulnerabilities allows attackersto compromise the logic of the application to perform client andserver-side attacks. HPP can be detected and avoided. But how?What you will learn What you should know what is HTTP Parameter Pollution (HPP) how to spoil HPP aws in web applications how to prevent HPP in web developing basic understanding of web technologies and languages web security knowledge is a plusIn the last twenty years, web applications have grownfrom simple, static pages to complex, full-fledgeddynamic applications. Web applications can acceptand process hundreds of different HTTP parameters tobe able to provide users with rich, interactive services. Asa result, dynamic web applications may contain a widerange of input validation vulnerabilities such as CrossSite Scriptingg (XSS) and SQL injection (SQLi). Accordingto the OWASP Testing Guide v3, The most common webapplication security weakness is the failure to properlyvalidate input coming from the client or environmentbefore using it. This weakness leads to almost all of themajor vulnerabilities in web applications [.]. Several kindof injection flaws exist and they are usually strictly relatedto the specific metalanguage used by the subsystems:XML Injection, SQL Injection, LDAP Injection, etc. Eachapplication layer uses a specific set of technologies and acharacteristic contextual language.In 2009, Luca Carettoni and Stefano di Paolaintroduced a new class of web vulnerabilities calledHTTP Parameter Pollution (HPP) that permits to injectnew parameters inside an existing HTTP parameter.Lately, in 2010, Marco Balduzzi of the InternationalSecure Systems Lab at EURECOM investigated theproblem and developed a system, called PAPAS, todetect HPP flaws in an automated way. He used PAPASto conduct a large-scale study on popular websites anddiscovered that many real web applications are affectedby HPP flaws at different levels.18This article discusses why and how applicationsmay be vulnerable to HTTP Parameter Pollution. Byanalyzing different attacking scenarios, we introducethe HPP problem. We then describe PAPAS, thesystem for the detection of HPP flaws, and we concludeby giving the different countermeasures that consciousweb designers may adopt to deal with this novel classof injection vulnerabilities.Parameter PrecedenceIn the context of websites, when the user’s browserwants to transfer information to the web application(e.g. a server-side script), the transmission can beperformed in three different ways. The HTTP protocolallows to provide input inside the URI query string(GET parameters), in the HTTP headers (e.g. withinthe Cookie field), or inside the request body (POSTparameters). The adopted technique depends on theapplication and on the type and amount of data that hasto be transferred.This standard mechanism for passing parameters isstraightforward, however, the way in which the querystring is processed to extract the single values dependson the application, the technology, and the developmentlanguage that is used.The problem arises when a developer expects to receivea single parameter and, therefore, invokes methods (suchas Request.getParameter in JSP) that only return a singlevalue. In this case, if more than one parameter with the07/2011
HTTP Parameter Pollutionsame name is present in the query string, the one that isreturned can either be the first, the last, or a combinationof all occurrences. Since there is no standard behavior inthis situation, the exact result depends on the combinationof the programming language that is used, and the webserver that is being deployed. Table 1 shows severalexamples of the parameter precedence adopted bydifferent web technologies.Note that the fact that only one value is returned isnot a vulnerability per se. However, if the developer isnot aware of the problem, the presence of duplicatedparameters may produce an anomalous behavior inthe application that can be potentially exploited by anattacker. As often in security, unexpected behaviors area usual source of weaknesses that could lead to HTTPParameter Pollution attacks in this case.HTTP Parameter PollutionIn a nutshell, HTTP Parameter Pollution allows tooverride or introduce new HTTP parameters by injectingquery string delimiters. This attack occurs when amalicious parameter, preceded by an (encoded) querystring delimiter, is appended into an existing parameterP host. If P host is not properly sanitized by the applicationand its value is later (decoded and) used, the attacker isable to inject one or more new parameters.The RFC 3986 defines the ampersand (&) symbolbeing the standard query string delimiter, but someapplications may user different symbols ( ,;). In thebasic form of parameter pollution the attacker encodeshis delimiter using the percent-encoding method (%FF);then depending from the application, other encodingschema like the double-encoding one (%25FF) can beadopted, or may reveal being unnecessary (ref. theGoogle Blogger example).As a consequence of an HPP flaw, the attacker maybe able to override a parameter that is submitted by auser to the application or that is fetched from a databaseserver by the backend logic. These two scenarios resultin two flavours of HTTP Parameter Pollution: client-sideand server-side.HPP Client-SideIn a typical client-side scenario (ref. Figure 1), amalicious user is interested into distributing a maliciousURL that triggers the HPP vulnerability and runs anunintended attack to his victims.For example, consider a website for the election oftwo candidates. The application uses a parameter pollid to look-up the candidates, to build the appropriatelinks for voting and to generate the election page.URL: http://host/election.jsp?poll id 4568Link A: a href ”vote.jsp?poll id 4568&candidate white” Vote for Mr. White /a www.hakin9.org/enLink B: ahref ”vote.jsp?poll id 4568&candidate green” Vote for Mrs. Green /a Now suppose that an attacker Mallory wants to subvertthe results of the election by forcing their victims intounintentionally voting for Mrs. Green. Mallory createsand distributes the following trigger URL to theirvictims:Trigger URL:http://host/election.jsp?poll id 4568%26candidate%3DgreenNote how Mallory polluted the poll id parameter byinjecting into it a new candidate green parameter. Byclicking on the trigger URL, the victims are redirectedto the vulnerable election website that now offers apage containing two injected links (Link A1 and B1contain the new candidate):Link A1: ahref vote.jsp?poll id 4568&candidate green&candidate white Vote for Mr. White /a Link B1: ahref vote.jsp?poll id 4568&candidate green&candidate green Vote for Mrs. Green /a No matter which link users click on, the application(in this case the JSP script) will receive two candidateparameters. Furthermore, since the first parameter willalways be set to green, the candidate Mrs. Green willalways be voted.It’s important to note that in order to perform asuccessful attack the parameter precedence mustbe consistent with the position where the injectedparameter is placed. In the example, if the developerused a standard JSP’s Request.getParameter(„par”)function, only the first value (the injected one) isreturned to the application, and the second value (theone carrying the user’s actual vote) is discarded.HPP Server-SideWhile in a client-side attack the goal of the bad guyis to attack other users, in the server-side variant theTable 1. Parameter precedence in the presence of multipleparameters with the same nameLanguage/ServerTested g("par")All (commadelimited string)PHP/Apache hegetvalue("par")All (list)19
ATTACK Figure 1. A standard client-side HPP attackattacker leverages a vulnerable web application toaccess protected data or perform actions that either notpermitted or not supposed to be executed.The following example describes how an attacker canexploit a HPP flaw to alter a database query in a usefulway.Let’s consider the application printEmploys thataccepts a single parameter called department to specifyfor which department the client has requested the listof users. The value of this parameter is decoded andused by the backend to execute a query (select) on thedatabase. A second parameter called what is hardcodedin the backend code and specifies which resourceshould be retrieved (the list of users).If the department parameter is not sanitized, an attackermay be able to introduce a second what parameterby encoding his value using the standard percentencoding method. As the following snippet details, thebackend is developed using the ASP technology andthe values of the two parameters with the same name(what) are concatenated via comma. This will resultin a query that selects for the list of users and theirassociated passwords.Malicious URL:Back-end:department engineering dbconnect.asp?what users&department engineering&what passwdDatabase:URL: printEmploys?department engineeringBack-end: dbconnect.asp?what users&department engineeringDatabase: selectusersfromtablewhereprintEmploys?department ablewheredepartment engineeringObviously, the real impact of this attack scenariodepends on how the application treats query results. Figure 2. The server-side attack2007/2011
HTTP Parameter PollutionIn order to show the risk introduced by HPP attacks,let’s also consider the following code snapshot of an ebanking application:void private executeBackendRequest(HTTPRequest request){String amount request.getParameter(„amount”);also be used to override parameters between differentinput channels (e.g., GET, POST, or HEADER fields). Inthe next snippet, the attacker forces the client to builda request that can potentially override the value of theid 1 POST parameter. This is achieved by injecting theid 6 in the vulnerable parameter via GET.String beneficiary request.getParameter(„recipient”);”action transfer&amount ” amount ”&recipient ” beneficiary );URL: foo?vulnerable-parameter foo%26id%3d6FORM:} form action buy?vulnerable-parameter foo&id �,”POST”, input type ”text” name ”id” / In this example, a frontend resource provides proxyfunctionalities to an internal application resource. Asmindful readers have probably noticed, a malicioususer could potentially pollute the recipient parameterwith the %26action% 3ddeposit attack payload.As a result, the backend request will look like: input type ”submit” value ”Submit” / /form Request:POST/buy?vulnerable parameter foo&id 6Host: site.comaction transfer&amount 1000&recipient Mat&action depositid 1Assuming that request is processed by a webframework which considers the last occurrence ofmultiple parameters (e.g. PHP), the overall actionwould allow an unauthorized deposit operation of1000 .For instance in Apache Tomcat, the previous requestwould result in a selection of the item with id number6. In fact, such web application environment considersthe first occurrence of multiple parameters selectingGET parameters first.For web application frameworks that concatenatemultiple values of the same parameter (e.g. ASP), anattacker could use HPP to launch traditional web attacks(e.g. SQL Injection) bypassing web application firewalls(WAFs). As a matter of fact, HPP can be successfullyOther UsesIn a previous example, we described how an attackercan pollute a link by injecting a new parameter into anexisting parameter of a GET request. HPP attacks can Figure 3. An example of HPP server-side vulnerability affecting an ebanking applicationwww.hakin9.org/en21
ATTACKused to split malicious payloads and avoid signaturebased detection.In ASP, the two query strings var foo&var bar andvar foo,bar are equivalent as the second one can beobtained by the server-side concatenation of parameters.The following shows how an attacker can setup aSQL Injection attack by splitting his query into multipleparameters with the same name.The following URLs show how the CSRF protectionadopted by Yahoo Mail! has been bypassed (inyear 2009) via HPP. This client-side attack allowedan attacker to trick his victims into deleting all theirpersonal e-mails. Note that the secret token is presentin the .rand parameter.URL:showFolder?fid Inbox&order down&tt 24&pSize 25&startMid 0%2526cmd fmgt.emptytrash%26DEL 1%26DelFID Inbox%26cmd fmStandard SQLi:show user.aspx?id 5;select 1,2,3 from ugt.deleteshow user.aspx?id 5;select 1&id 2&id 3 fTricking a victim into clicking on the above link allowedan attacker to initiate a delete operation without theknowledge of the anti-CSRF token. In the victim’spage, the previous request would result in the link:sers where id 1--SQLi over HPP:rom users where id 1--Lavakumar Kuppan published an alternative versionof this example where commass introduced by theconcatenation are stripped out with inline comments(only on Microsoft SQL Server).showMessage?sort date&order down&startMid 0%26cmd%3Dfmgt.emptytrash&DEL 1&DelFID Inbox&cmd fmgt.delete&.rand 1076957714Standard SQLi:show user.aspx?id 5 union select * from users--SQLi over HPP:show user.aspx?id 5/*&id */union/*&id */select */*&id */from users--HPP in real-lifeSo far, we have illustrated several hypothetical situationswhere HPP can be used to override existing hard-codedHTTP parameters, modify the application behaviors andpotentially exploit uncontrollable variables. Unfortunately,HPP vulnerabilities exist in real web applications too.A dangerous utilization of HPP consists into bypassingthe token protection mechanism used to prevent CrossSite Request Forgery (CSRF) vulnerabilities. In thiscase, a unique token is generated by the applicationand inserted in all links to sensitive URLs. When theapplication receives a request, it verifies the tokenbefore authorizing the action. Hence, since the attackercannot predict the value of the token, she cannot forgethe malicious URL to initiate the action.Figure 4. An example of content pollution using HPP22A second click on any link in the webmail wouldirremediably empty the user’s trash.Interested readers can obtain further details watchinga demonstration video (http://www.youtube.com/watch?v -O1y7Zy3jfc) of the proof-of-concept attack.Another HPP vulnerability turned out to affect AppleCups, the well-known printing system used in Mac OSX and many UNIX systems. Exploiting HPP, an attackercould easily trigger a Cross-Site Scripting vulnerability.http://127.0.0.1:631/admin/?kerberos onmouseover alert(1)&kerberosThe application validation checkpoint could bebypassed by adding an extra kerberos argument havinga valid string as content (e.g. empty string). As thevalidation checkpoint would only consider the secondoccurrence, the first kerberos parameter in vulnerableversions is not properly sanitized before being usedFigure 5. Sharing components on the web07/2011
HTTP Parameter Pollutionto generate dynamic HTML content. Successfulexploitation would result in Javascript code executionunder the context of the hosting web site.An even more critical vulnerability has been recentlypatched by Google in its popular blogging platform.An HPP bug in Blogger allowed malicious user totake ownership of the victim’s blog. In detail, thisauthentication flaw exploited how different applicationlayers consider multiple occurrences, treating eitherthe first or the second occurrence. Nir Goldshlagerdiscovered that the following request (note the twoblogid parameters) would result in the attacker addedas an author on the victim’s blog:POST /add-authors.do HTTP/1.1security token attackertoken&blogID attackerblogidvalue&blogID victimblogidvalue&authorsList goldshlager19test%40gmail.com(attacker email)&ok InviteThe flaw resided in the authentication mechanismused by Blogger. The validation was performed onthe first parameter, whereas the actual operation usedthe second occurrence. From that, the attacker couldeasily elevate his privileges from author to adminthanks to the following request:A simple example is briefly illustrated in Figure 4.In this case, tampering the product code (pparameter) an aggressor may be able to createmisleading situations within an e-commerce site. Theonline customer see the description of product #67760,however it’s actually buying product #67765.Finally, one of the author discovered that the sharingfunctionality offered by Facebook was prone toparameter pollution client-side attacks. We are talkingof the well known like and share buttons commonlyfound on blogs and news (ref. Figure 5). This attackis possible when the website (client) that uses thesharer API does not properly sanitizes the values sentto Facebook (server). In this situation, the attacker canabuse of a vulnerable page to inject a second referenceparameter (called u) into the description parameter tooverwrite the URL to share.For example, given a vulnerable page ofwww.vulnerable.com, the following URL: http://www.vulnerable.com/shareurl.jsp?shareurl http://www.vulnerable.com/news.html&description The news page of vulnerable.com%26u%3Dattackerurlreturns a page polluted with the Facebook injected link(the precedence is on the second parameter): http://www.facebook.com/sharer.php?u http://www.vulnerable.com/news.html&r The news page of vulnerable.com&u attackerurl.POST /team-member-modify.do HTTP/1.1Facebook fixed this issue by checking that the URL toshare is sent once to the component.security token attackertoken&blogID attackerownblogid&Automated Detection with PAPASblogID victimblogidvalue&memberID attackermemberid&isMarco Balduzzi and colleagues developed a toolcalled PAramater Pollution Analysis System (PAPAS)to automate the detection of HPP flaws in WebApplications. PAPAS consists of four main components:A browser, a crawler, and two scanners. Figure 1illustrates the global architecture of PAPAS.The first component is an instrumented vesionof Firefox. The browser is responsible for fetchingwebpages, rendering their content, and extracting allAdmin true&ok Grant admin privilegesA demonstration video for this vulnerability can bewatched on YouTube (http://www.youtube.com/watch?v AdIWl0gkynk).kThen, HPP can also be used to create phishing trapsor trick the user into performing involuntary actionsthrough UI-Redressing or content pollution attacks. Figure 6. PAPAS global architecturewww.hakin9.org/en23
ATTACKthe links and form URLs contained in the page. The bigbenefit of having adopted a real browser instead of acustom HTTP/HTML client to render the pages, is thatthe browser provides for free an engine for handlingclient-side scripts (e.g. Javascript) and complexdynamic applications (IFRAMEs, events).That is, when the crawler issues a new page to betested, the browser in PAPAS first waits until the targetpage is loaded; after the browser parses the DOM,executes any client-side scripts, and loads additionalresources; then a browser extension extracts thecontent, the list of links, and the forms in the page.This extension has been developed using the standardtechnology offered by the Mozilla developmentenvironment: a mix of Javascript and XML UserInterface Language (XUL) and XPConnect to accessFirefox’s XPCOM components. These componentsare used for invoking GET and POST requests and forcommunicating with the scanning components.The crawler communicates with the browser through abidirectional TCP/IP channel. This channel is used by thecrawler to inform the browser on the URLs that need tobe visited, and on the forms that need to be submitted.Furthermore, the channel is also used to retrieve thecollected information from the browser. The crawlerautomatically fills forms with guesses data, for examplerandom alphanumeric values of 8 characters are insertedinto password fields and a default email address isinserted into fields with the name email, e-mail, or mail.When the authenticated area of a site wants to be tested,the crawler can be assisted by manually logging intothe application using the browser, and then specifyinga regular expression to be used to prevent the crawlerfrom visiting the logout page (e.g., by excluding links thatinclude the cmd logout parameter).Every time the crawler visits a page, it passes theextracted information to the two scanners so that itcan be analyzed. The parameter Precedence Scanner(P-Scan) is responsible for determining how the pagebehaves when it receives two parameters with thesame name; the Vulnerability Scanner (V-Scan) teststhe page to determine if it is vulnerable to HPP attacks.The Precedence Scanner starts by taking the firstparameter of the URL (in the form par1 val1), andgenerates a new parameter value val2 that is similarto the existing one. In a second step, the scanner asksthe browser to generate two new requests. The firstrequest contains only the newly generated value val2.In contrast, the second request contains two copies ofthe parameter, one with the original value val1, and onewith the value val2. Example:Page0 – Original Url: application.php?par1 val1&par2 val2Page1 – Request 1: application.php?par1 new val&par2 val2Page2 – Request 2: application.php?par1 val1&par1 newval&par2 val2Figure 7. The online version of PAPAS24A naive approach to determine the parameterprecedence would be to simply compare the three pagesreturned by the previous requests: If Page1 Page2, thenthe second (last) parameter would have precedenceover the first. If, however, Page2 Page0, the applicationis giving precedence to the first parameter over thesecond. Unfortunately, this straightforward approachdoes not work well in practice. Modern web applicationsare very complex, and often include dynamic content(e.g. banners) that may still vary even when the pageis accessed with exactly the same parameters. To solvethis problem, the P-Scan component first pre-process thepage by trying to eliminate content that does not dependon the parameter values, and then uses mathematicalheuristics to compute the similarity among pages (moredetails in the references).The Vulnerability Scanner tests the page to determineif some parameters can be injected by HPP. For everypage that V-Scan receives from the crawler, it tries toinject a URL-encoded version of an innocuous parameter(a nonce) into each existing parameter of the query stringand possibly of the page. Then, for each injection, thescanner verifies the presence of the parameter in links,action fields and hidden fields of forms in the answerpage. For example, given a parameter par1 val1, V-Scan07/2011
HTTP Parameter PollutionOn the ‘Net http://www.iseclab.org/people/embyte/slides/bh series.pdff – Slides on HTTP Parameter Pollutionhttp://papas.iseclab.org// – The PAPAS /BHEU2011/whitepaper-bhEU2011.pdff – The Blackhat white paper on ParameterPollutioninjects build a request as par1 val1%26foo%3Dbar and thenchecks if the nonce &foo bar has been used to build a linkor a form in the answer page. This technique works wellfor parameters that are reused by the application underthe same or different name.The scanner supports three different operationalmodes: fast mode, extensive mode and assisted mode.The fast mode aims to rapidly test a site for potentialvulnerable parameters and enables the standard tests.In the extensive mode, the scanner pickup each singleparameter from the page’s content and injects the nonce.The extensive mode is lower but tries to detect injectionsin parameters that were not used in the original page.The assisted mode allows the scanner to be usedin an interactive way. That is, the crawler pauses andspecific pages can be tested for parameter precedenceand HPP vulnerabilities. As a result, the assisted modecan be used by security professionals to conduct semiautomated assessment of web applications, or to testwebsites that require a particular user authentication.In the current version of PAPAS the vulnerabilityscanner only looks for client-side vulnerabilities. Infact, testing for server-side attacks using a black-boxapproach (that one used by PAPAS) is more difficultthan testing for client-side attacks as comparingrequests and answers is not sufficient.Free-to-use online serviceMarco has recently deployed an online version of PAPAS,shows in figure 6, that allows website maintainers to scantheir sites for HTTP Parameter Pollution vulnerabilities.Web developers and analysts can submit their sitesto PAPAS for being tested, without any additional fee.PAPAS uses a challenge-response mechanism based ontokens (called PAPAS.txt) to prove that the submissioncomes from the developer/maintainer of the site. Oncethe site has been validated, an automated engine queuesthe submission and contacts the user when the scan iscompleted and the HTML report is available.The submission is customizable and settings suchas scanning depths, delaying times between requests,precedence and vulnerability scanning engines,extensive operational mode and URL to exclude are allconfigurable by the analyst.CountermeasuresBeing aware of this new class of vulnerabilities givesyou a competitive advantage over the attackers. If youwent through the entire article, it should be already clearwww.hakin9.org/enhow malicious users can abuse your application andwhat is the root cause of this security problem.As for every input validation vulnerability, filteringis the main countermeasure to avoid that maliciouspayloads can be injected in the application. In case ofHPP, the query string delimiter and its encoded versionsare the dangerous characters to be properly filtered.Input validation and output encoding allow to protectour applications against HPP attacks.As a final remark, we would like to suggest to thereader a few general recommendations: Encode query string delimiters using URL nting your business logicPerform proper channel (GET/POST/Header fields)validationUse strict regexp in URL rewritingLastly, it’s important to know our systems and thetechnology used in our application environments sothat data validation and encoding can be applied forthe right context.MARCO BALDUZZIMarco embyte Balduzzi, MSc. in Computer Engineering,has been involved in IT-Security for more than 8 years withinternational experiences in both industrial and academic elds. He has worked as security consultant and engineerfor different companies before joining a Ph.D. program inEURECOM (iSecLab group). He attended well-known and highpro le conferences all over (BlackHat, OWASP AppSec, NDSS)and in former times was an active member of open-sourceprojects and Italian hacking groups.LUCA CARETTONILuca ikki Carettoni, MSc. in Computer Engineering with amajor specialization in web application and Java security.He has published several research papers, vulnerabilityadvisories and articles on computer security. In short, hebreaks things for a living.STEFANO DI PAOLAStefano Di Paola is the CTO and a cofounder of MindedSecurity, where he is responsible for the Research andDevelopment Lab. Prior to founding Minded Security, Stefanowas a freelance security consultant, working for severalprivate and public companies. Stefano is recognized as one ofthe top application security researchers.25
Parameter Pollution attacks in this case. HTTP Parameter Pollution In a nutshell, HTTP Parameter Pollution allows to override or introduce new HTTPparameters by injecting query string delimiters. This attack occurs when a malicious parameter, preceded by an (encoded) query string delimiter, is appended into an existing parameter P_host.
HTTP Parameter Pollution A new class of Injection Vulnerability called HTTP Parameter Pollution (HPP) is less known Has not received much attention First presented by S. di Paola and L. Carettoni at OWASP 2009 Attack consists of injecting encoded query string delimiters into existing HTTP parameters (e.g. GET/ POST/Cookie)
HTTP Parameter Pollution (HPP) in detail . HTTP Parameter Pollution, as implied by the name, pollutes the HTTP parameters of a web application in order to perform or achieve a specific malicious task/attack different from the intended behaviorof the web application. This hacking technique is considered to be simple but quite effective, .
HTTP Parameter Pollution attacks (HPP) have only recently been presented and discussed [27], and have not received much attention so far. An HPP vulnerability allows an attacker to inject a parameter inside the URLs generated by a web application. The consequences of the attack depend on the application’s logic, and may
Parameter pollution techniques are used to override values on parameters. They are well known in the HTTP [5] environment but they are also applicable to other environments. In this example, parameter pollution techniques can be applied to parameters in the connection string, allowing several attacks. 2.3 Connection String Parameter Pollution .
Contents iii Cisco Unified Contact Center Express Editor Step Reference Guide, Release 10.0(1) CGI Variables tab (Get Http Contact Info step) 2-74 Http Forward Step 2-76 Http Include Step 2-79 Http Redirect Step 2-81 Send Http Response Step 2-82 Set Http Contact Info Step 2-83 General tab (Set Http Contact step) 2-84 Headers tab (Set Http Contact step) 2-85
Unit 5 : Environmental Pollution Definition Cause, effects and control measures of :- a. Air pollution b. Water pollution c. Soil pollution d. Marine pollution e. Noise pollution f. Thermal pollution g. Nuclear hazards Solid waste Management : Causes, effects and control measures of urban and industrial wastes.
causing pollution. Nemerow’s pollution index (NPI) is a simplified pollution index introduced by Neme [9] which is also known as Raw’s pollution index. NPI provides information about extent of pollution for a particular water quality parameter with reference to its standard value. By
Business-Level Strategies 23.11.2010 4. What is a Strategic Business Area? Demand Demand potential (size, growth rate, market share) Customers Customer potential customer structure, buying motives and criteria) Competition Structure of the competition, the competitors' objectives and strategies, competitive position Specific resources and competences (the strategic capabilities) Organisation .