performing-http-parameter-pollution-attack

Send duplicate parameters like 'q=first&q=second' with curl or Burp Repeater and observe which value the application uses. A vulnerability exists when the WAF or validator reads one copy while the business logic acts on the other, producing a security-relevant behavioral change.

Apache/PHP uses the last value, ASP.NET/IIS concatenates values with commas, JSP/Tomcat and Python/Flask use the first value, and Node.js/Express returns an array. Test empirically against the detected stack rather than assuming precedence.

Yes, when the WAF inspects each parameter value individually but the server concatenates duplicates, splitting a SQLi or XSS payload across two parameters can evade detection. Confirm the bypass by proving the reassembled payload executed while each half alone is blocked.

Burp Suite with the param-miner extension handles manual duplication and hidden parameter discovery, while OWASP ZAP provides automated HPP scanning. curl, ffuf, and Arjun support manual crafting and parameter fuzzing.

Identical behavior to a single parameter, with no precedence split and no divergence between validator and business logic, means the application is not vulnerable. Always require an attributable differential, such as a price or role override, before reporting a finding.