http-parameter-pollution

HTTP parameter pollution (HPP) exploits inconsistent interpretation of duplicate parameter keys across request processing layers like WAF and proxies. By sending duplicate parameters, the WAF validates one value while the origin application processes another, achieving bypass.

To test duplicate HTTP parameter handling in web APIs, send duplicate query or body parameters with swapped order, then fingerprint whether each layer selects the first, last, or joins values. Verify which occurrence drives sensitive actions or security checks to expose inconsistencies.

Inconsistent request parsing can cause SSRF and CSRF token confusion. When reverse proxies and application frameworks interpret duplicate parameter names differently, internal HTTP clients may fetch a secondary URL or validate the wrong token value, enabling logic abuse.

HTTP parameter pollution works with form-data body parameters as well as query strings. The testing approach generates duplicate-key payload variants for both query and body formats to detect parser differentials across CDN, proxies, and application frameworks.

The best way to fingerprint first versus last parameter winning behavior is sending duplicate keys with swapped ordering to the target. Analyzing whether the front stack and origin app disagree on the winning value reveals parser assumptions for scenario-driven verification.