http-parameter-pollution

HTTP Parameter Pollution (HPP) occurs when duplicate query or body keys are interpreted differently across browsers, servers, proxies, and frameworks, leading to inconsistent behavior and potential bypass vectors.

Test HPP by sending requests with duplicate parameters across query and body to observe how each stack layer, from CDN and reverse proxy to app framework and business logic, resolves the values.

Yes, you can explore attack scenarios including bypass, SSRF redirection, and token confusion by orchestrating multiple hops for parameter resolution to reveal inconsistencies across web deployment components.

This approach satisfies requirements for deterministic payloads, cross-stack testing, and comprehensive coverage of common frameworks and transports where multiple hops interpret duplicate parameters differently.

Validate mitigation strategies by checking if an application exposes different results when the same parameter appears multiple times, testing how various components like servers and proxies resolve the duplicates.

Servers, proxies, and application frameworks parse duplicate HTTP parameters using different resolution rules, creating inconsistencies that enable logic abuse, bypass vectors, and token confusion across the request pipeline.