where the WAF checks only the first q value."}},{"@type":"Question","name":"Does HPP testing apply to GraphQL and WebSocket APIs?","acceptedAnswer":{"@type":"Answer","text":"Yes, GraphQL is vulnerable through alias pollution, duplicate variables, and batch mutations that bypass rate limits. WebSockets can carry polluted parameters in upgrade request URLs and duplicate keys in JSON message payloads."}},{"@type":"Question","name":"What are the limitations of parameter pollution attacks?","acceptedAnswer":{"@type":"Answer","text":"HPP only works when application layers handle duplicates inconsistently; modern frameworks with schema enforcement, edge normalization, and explicit parser settings reject duplicates. Impact is low when no security decision depends on the polluted parameter."}}]}]}

Verified:GitHub

parameter-pollution

Tests web applications for HTTP parameter pollution and duplicate parameter handling flaws.

Updated Jun 26, 2026

Search Tags:#penetration testing #web security #bug bounty #waf bypass #hpp #http parameter pollution #duplicate parameters

One-click install

npx skills add https://github.com/brukal001/brukal --skill parameter-pollution-brukal001

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: parameter-pollution
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/web/offensive-parameter-pollution
Command: npx skills add https://github.com/brukal001/brukal --skill parameter-pollution-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web servers, frameworks, proxies, and WAFs each handle duplicate HTTP parameters differently, creating gaps attackers exploit to bypass access controls, evade WAFs, and manipulate data. This Skill provides a structured checklist to systematically find and exploit these inconsistencies during authorized security testing. ## Core Features & Use Cases - Duplicate Parameter Testing: Methodology for URL, form, JSON, cookie, header, GraphQL, and WebSocket parameter pollution with framework-specific behavior notes (PHP last-wins, ASP.NET first-wins, Flask arrays). - Exploitation Patterns: Concrete payloads for access control bypass, CSRF token pollution, SSRF augmentation, WAF bypass, and API gateway vs backend precedence confusion. - Real-World Context: CVE references, bug bounty target categories, impact ratings, and remediation recommendations. - Use Case: While testing an e-commerce checkout endpoint, apply the checklist to discover that the API gateway validates the first `price` parameter while the backend processes the last, enabling price manipulation. ## Quick Start Use the parameter-pollution skill to test the target application's login and checkout endpoints for duplicate parameter handling flaws.

Frequently Asked Questions about parameter-pollution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for HTTP parameter pollution vulnerabilities?▼

Identify all application parameters in URLs, forms, cookies, and headers, then send duplicate parameters with different values such as param=value1&param=value2. Observe which value the application uses (first, last, or concatenated) and look for inconsistencies between layers like WAF and backend.

What tools are used for HPP testing?▼

Burp Suite Pro with Repeater and Intruder is the primary tool for parameter pollution testing. Param Miner discovers hidden parameters, OWASP ZAP provides HTTP fuzzing, and Schemathesis fuzzes OpenAPI-defined endpoints for duplicate-field handling.

How do different frameworks handle duplicate parameters?▼

ASP.NET/IIS and JSP/Tomcat use the first occurrence, PHP/Apache uses the last, Perl CGI concatenates with commas, and Python/Flask builds arrays. Node.js Express behavior depends on whether the querystring or qs parser is configured.

Can parameter pollution bypass a WAF?▼

Yes, when the WAF inspects the first parameter occurrence but the backend processes the last, malicious payloads pass through undetected. Example: q=safe&q=<script>alert(1)</script> where the WAF checks only the first q value.

Does HPP testing apply to GraphQL and WebSocket APIs?▼

Yes, GraphQL is vulnerable through alias pollution, duplicate variables, and batch mutations that bypass rate limits. WebSockets can carry polluted parameters in upgrade request URLs and duplicate keys in JSON message payloads.

What are the limitations of parameter pollution attacks?▼

HPP only works when application layers handle duplicates inconsistently; modern frameworks with schema enforcement, edge normalization, and explicit parser settings reject duplicates. Impact is low when no security decision depends on the polluted parameter.