offensive-parameter-pollution

SKILL: HTTP Parameter Pollution (HPP)

Metadata

• Skill Name: parameter-pollution
• Folder: offensive-parameter-pollution
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/parameter-pollution.md

Description

HTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.

Trigger Phrases

Use this skill when the conversation involves any of: parameter pollution, HTTP parameter pollution, HPP, duplicate parameter, WAF bypass, parsing differences, server-side HPP, client-side HPP, parameter injection

Full Methodology

HTTP Parameter Pollution (HPP)

Mechanisms

HTTP Parameter Pollution (HPP) is a web attack technique that exploits how web applications and servers handle multiple occurrences of the same parameter name. When a web application receives duplicate parameters, different technologies process them differently:

flowchart TD
    subgraph "HTTP Parameter Pollution"
    A[Multiple occurrences of same parameter] --> B{Server Technology}
    B -->|ASP.NET/IIS| C[Uses first occurrence]
    B -->|PHP/Apache| D[Uses last occurrence]
    B -->|JSP/Tomcat| E[Uses first occurrence]
    B -->|Perl CGI| F[Concatenates with comma]
    B -->|Python/Flask| G[Builds array of values]
    B -->|Node.js/Express| H[Uses first occurrence]
    end

Parameter Handling Behaviors

• ASP.NET/IIS: Uses the first occurrence of the parameter
• PHP/Apache: Uses the last occurrence of the parameter
• JSP/Tomcat: Uses the first occurrence of the parameter
• Perl CGI/Apache: Concatenates all occurrences with a comma delimiter
• Python/Flask: Builds an array of values
• Node.js/Express: Uses the first occurrence by default

Notes and modern caveats

• Node.js express uses either querystring (first-wins) or qs (arrays/last-wins). app.set('query parser', 'extended') changes behavior. Many middlewares assume param[]=a&param[]=b for arrays; duplicates without [] can produce surprising results.
• Spring MVC/Spring Boot binders often collect duplicates into lists; API gateways (Kong, APIGEE, NGINX, Cloudflare) may collapse/normalize differently than backends.
• JSON duplicate keys: most parsers accept last-wins; some gateways reject duplicates while backends accept, creating precedence gaps.
• Cookies: duplicate cookie names and comma/semicolon handling vary by proxies/agents.