hunt-parameter-pollution

HTTP Parameter Pollution occurs when multiple processing layers like CDN, WAF, app, and backend handle the same parameters differently, creating precedence gaps that attackers exploit to bypass security rules across URL, form, JSON, GraphQL, and cookie inputs.

You can test for HPP vulnerabilities by applying a structured methodology to inject duplicate parameters across URL, form, JSON, GraphQL, and cookie inputs, mapping how technologies like ASP.NET, PHP, Flask, Express, and Perl resolve conflicting values to identify exploitable conditions.

Yes, you can assess parameter handling precedence by injecting polluted parameters and observing which value is retained by each layer, specifically revealing conflicting rules between WAF, CDN, and backend application layers for remediation planning.

The best way to document HPP findings is to record practical attack patterns alongside CVE references, mapping the specific parameter precedence gaps discovered across processing layers to support risk assessment and remediation efforts.

Yes, HPP testing works with JSON and GraphQL parameter inputs alongside URL, form, and cookie parameters, systematically evaluating how each processing layer parses and retains values across these diverse input formats.