http-parameter-pollution

An attack playbook for HTTP Parameter Pollution (HPP), for authorized web security testing. HPP arises when a request contains duplicate query-string or body keys, for example a=1&a=2, and the different components along the request path (CDN, WAF, reverse proxy, application framework, and business code) resolve them inconsistently. Because duplicate keys are not an error at the HTTP level, each hop may take the first value, the last, join them, or turn them into an array, and the security check may read a different occurrence than the action that follows.

A central server-behavior matrix documents typical defaults across stacks. For instance, PHP, Django, and Rack tend to keep the last occurrence, Flask, Tomcat, and Go net/http keep the first, ASP.NET often comma-joins all values, and Express returns an array, while the guide stresses that middleware and custom parsers override these, so behavior must always be confirmed. Payload patterns cover basic duplicates, array-style and mixed array/scalar keys, encoded-ampersand parser differentials, nested bracket keys, and JSON duplicate keys.

The attack scenarios chain HPP into real impact: bypassing a WAF that inspects the first value while the app uses the last, SSRF where a validator reads a safe URL but the fetcher reads an internal one, CSRF token confusion, and business-logic abuse of numeric fields such as payment amount or quantity. It recommends tooling, including Burp Suite Repeater with Param Miner, OWASP ZAP's manual request editor, and custom scripts that preserve raw ordering, and it provides a decision tree. Throughout it emphasizes running only where explicitly authorized, since HPP can change server state such as payments or account settings.