http-parameter-pollution

HTTP parameter pollution occurs when duplicate query or body keys are interpreted differently by intermediaries like WAFs and application layers, allowing security checks to read one value while business logic reads another to bypass protections.

You test for duplicate parameter handling by sending duplicate query or body keys and validating how each layer resolves first-value, last-value, merge, and array parsing behaviors across multi-hop request chains to expose parser differentials.

Yes, you can use duplicate keys, bracketed arrays, encoded separators, and JSON duplicate members to confirm parser differentials across GET, POST, and multipart requests between intermediaries and application code.

The best way to detect WAF bypass and SSRF vulnerabilities is to compare layer-by-layer parameter precedence across the request path, testing exploit patterns like URL swapping and token confusion using duplicate parameters.

Yes, this testing applies to multi-hop request chains involving CDNs, reverse proxies, and frameworks, validating parameter precedence across each intermediary to identify exploitable parser differences in web security testing.