# Parameter Pollution

> How to test for HTTP Parameter Pollution (HPP), JSON injection, and parameter parsing vulnerabilities in web applications. Use this skill whenever you're testing web apps for input validation issues, parameter manipulation, duplicate parameter handling, or JSON deserialization inconsistencies. Trigger this skill for any pentesting task involving URL parameters, form fields, API requests, or JSON payloads where parameter pollution could be exploited.

- Skill: `abelrguezr/parameter-pollution` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/parameter-pollution`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/parameter-pollution/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/parameter-pollution

---


# Parameter Pollution Testing

This skill helps you identify and exploit HTTP Parameter Pollution (HPP) and JSON injection vulnerabilities in web applications.

## Quick Start

1. **Identify the target technology** (PHP, Flask, Django, Node.js, etc.)
2. **Test parameter parsing behavior** using the technology-specific guide below
3. **Apply HPP techniques** based on how the target handles duplicates
4. **Test for JSON injection** if the application uses JSON APIs

## HTTP Parameter Pollution (HPP) Testing

### What is HPP?

HTTP Parameter Pollution occurs when an application processes duplicate HTTP parameters inconsistently. By adding, modifying, or duplicating parameters, you can manipulate application behavior.

**Example:**
```
Original:  https://victim.com/send/?from=accountA&to=accountB&amount=10000
Polluted:  https://victim.com/send/?from=accountA&to=accountB&amount=10000&from=accountC
```

The server might use `accountC` instead of `accountA` depending on its parameter parsing logic.

### Testing Methodology

#### Step 1: Identify the Technology

Use tools like [Wappalyzer](https://wappalyzer.com/) or inspect response headers to determine:
- Web framework (Flask, Django, Spring, Express, etc.)
- Server (Apache, Nginx, Tomcat, etc.)
- Language (PHP, Python, Node.js, Go, Ruby)

#### Step 2: Test Parameter Parsing Behavior

Send requests with duplicate parameters and observe which value the application uses:

```bash
# Test with curl
curl "https://target.com/api?param=value1&param=value2"

# Test with Burp Suite or similar proxy
GET /api?name=test1&name=test2 HTTP/1.1
Host: target.com
```

#### Step 3: Apply Technology-Specific Techniques

Refer to the **Technology Reference** section below for how each stack handles duplicates.

### Common HPP Attack Vectors

| Vector | Description | Example |
|--------|-------------|---------|
| **Parameter Override** | Duplicate a parameter to change its value | `?user=admin&user=victim` |
| **Parameter Injection** | Add new parameters via URL encoding | `?input=test%26malicious=value` |
| **Query Truncation** | Use `#` to truncate downstream queries | `?input=test%23` |
| **Array Injection** | Use `[]` syntax if supported | `?data[]=value1&data[]=value2` |

### Server-Side Parameter Pollution (SSPP)

Some applications embed user input into internal API requests. Test for SSPP by:

1. **Adding parameters** with `%26` (URL-encoded `&`)
2. **Truncating queries** with `%23` (URL-encoded `#`)
3. **Overriding existing parameters** by duplicating them

**Example:**
```http
GET /userSearch?name=peter%26name=carlos&back=/home
```

May result in internal request:
```http
GET /users/search?name=peter&name=carlos&publicProfile=true
```

### Client-Side HPP Testing

Inject URL-encoded `&` into reflected parameters:

```bash
# Inject %26 (URL-encoded &)
curl "https://target.com/search?q=test%26HPP_TEST"
```

Look for decoded occurrences in the response:
- `&HPP_TEST` - parameter was decoded and could be exploited
- `&HPP_TEST` - properly escaped, likely safe

## Technology Reference

### PHP (Apache)

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | Uses **last** parameter value |
| **Array syntax** | Recognizes `name[]` |
| **Null byte** | Ignores anything after `%00` in parameter name |
| **GET vs $_GET** | `$_GET` is not the same as GET method |

**Exploitation tip:** Place malicious value as the **last** duplicate parameter.

### Python Flask / Werkzeug

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | Uses **first** parameter value |
| **Array syntax** | Does NOT recognize `name[]` |

**Exploitation tip:** Place malicious value as the **first** duplicate parameter.

### Python Django

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | Uses **last** parameter value |
| **Array syntax** | Does NOT recognize `name[]` |

### Python Tornado

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | Uses **last** parameter value |
| **Array syntax** | Does NOT recognize `name[]` |

### Node.js Express

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | **Concatenates** values (e.g., `first,last`) |
| **Array syntax** | Recognizes `name[]` |

**Exploitation tip:** Use array syntax or expect comma-separated values.

### Go (Standard Library)

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | Uses **first** parameter value |
| **Array syntax** | Does NOT recognize `name[]` |

### Ruby WEBrick

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | Uses **first** parameter value |
| **Array syntax** | Does NOT recognize `name[]` |
| **Delimiters** | Uses both `&` and `;` to split parameters |

### Spring MVC / Tomcat

| Behavior | Details |
|----------|---------|
| **Duplicate handling** | **Concatenates** values (e.g., `first,last`) |
| **Array syntax** | Recognizes `name[]` in POST requests |
| **Priority** | Prefers `name` over `name[]` if both exist |
| **Content-Type** | Recognizes query parameters with Content-Type in POST |

## JSON Injection Testing

### Duplicate Keys

Different JSON parsers handle duplicate keys differently:

```json
{"test": "user", "test": "admin"}
```

- **Frontend** might use first value (`user`)
- **Backend** might use last value (`admin`)

This inconsistency can be exploited to bypass validation.

### Key Collision Techniques

Use special characters to create key collisions:

```json
{"test": 1, "test[raw \x0d byte]": 2}
{"test": 1, "test\ud800": 2}
{"test": 1, "test"": 2}
{"test": 1, "te\st": 2}
```

The frontend may see `test == 1` while the backend sees `test == 2`.

### Bypass Value Restrictions

```json
{"role": "administrator[raw \x0d byte]"}
{"role": "administrator\ud800"}
{"role": "administrator""}
{"role": "admini\strator"}
```

### Comment Truncation

Some JSON parsers support comments:

```json
{"test": 1, "extra": "a"/*, "test": 2, "extra2": "b"*/}
```

**Java GSON:**
```json
{"test": 1, "extra": "a"}
```

**Ruby simdjson:**
```json
{"test": 2, "extra": "a", "extra2": "b"}
```

### Float/Integer Precision Issues

Very large numbers may be decoded differently:

```json
{"id": 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999}
```

May become:
- `9.999999999999999e95`
- `1E+96`
- `0`
- `9223372036854775807` (max int64)

## Practical Testing Checklist

- [ ] Identify target technology stack
- [ ] Test duplicate parameter handling (first vs last vs concatenate)
- [ ] Test array syntax (`name[]`)
- [ ] Test URL-encoded parameter injection (`%26`)
- [ ] Test query truncation (`%23`)
- [ ] Test client-side HPP with reflected parameters
- [ ] Test JSON duplicate keys if API uses JSON
- [ ] Test JSON comment injection
- [ ] Test JSON key collision with special characters
- [ ] Test large number precision issues
- [ ] Document findings and affected endpoints

## Tools

- **Burp Suite** - Intercept and modify HTTP requests
- **Wappalyzer** - Identify technology stack
- **curl** - Quick parameter testing
- **Custom scripts** - See `scripts/` directory

## References

- [OWASP WSTG - HPP Testing](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution)
- [PortSwigger - Server-Side Parameter Pollution](https://portswigger.net/web-security/api-testing/server-side-parameter-pollution)
- [Bishop Fox - JSON Interoperability Vulnerabilities](https://bishopfox.com/blog/json-interoperability-vulnerabilities)
- [HTTP Parameter Pollution in 2024](https://medium.com/@0xAwali/http-parameter-pollution-in-2024-32ec1b810f89)