domains / families / security / http-parameter-pollution

http-parameter-pollution

separate

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.

When to use

• WAF and app disagreement on parameter values
• SSRF second URL exploitation
• Business logic abuse via duplicate parameters
• CSRF token confusion
• JSON duplicate key testing
• Content-Type confusion
• Fingerprinting front stack vs origin behavior

Skill page

Source