Skip to content
uencoder

HTTP Parameter Pollution

HTTP parameter pollution is attackers repeating the same parameter name in a request, exploiting per-framework value-selection differences to bypass validation.

Purpose

To understand the parsing differences and bypasses caused by repeated parameters; a common defect in WAFs and input validation.

Mechanism

For the request ?id=1&id=2, different frameworks take the first value, the last value, or an array. If a WAF checks the first value id=1 and passes while the backend uses the last value id=2, protection is bypassed. Defenses: a unified value-selection strategy, rejecting duplicate parameters.

Use cases

  • WAF bypass
  • Input validation audit
  • Parameter parsing security

Related tools

HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side.
TOOL
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side.
TOOL

References