HTTP parameter pollution (HPP) is an attack where the same parameter is sent more than once in a request. Different parts of a system may handle the duplicates differently, and an attacker can use that to bypass validation or change the application's behaviour.

HPP can affect both server-side and client-side components. The attacker adds extra parameters, or overrides existing ones, in the query string, the request body or cookies. Depending on the application, this can lead to cross-site scripting, privilege escalation or authorization bypass.

See it in action

This demonstration uses bWAPP, a deliberately vulnerable web application for practice, available from sourceforge.net/projects/bwapp. Only test applications you own or are authorised to test.

Submit the form on the page and look at the resulting URL. For example:

http://localhost/bWAPP/hpp-3.php?movie=9&name=test&action=vote

This request has three parameters. Now add the movie parameter a second time with a different value:

http://localhost/bWAPP/hpp-3.php?movie=9&name=test&action=vote&movie=2

If the application is vulnerable, it uses the second value, and the vote is counted for a different movie than the one selected.

Prevention

• Validate all input: forms, headers, cookies, hidden fields and URL parameters.
• Decide how duplicate parameters are handled and apply it consistently: reject them, or always take the same occurrence.
• Accept each parameter only from the place it is expected (query string, body or cookie).
• URL-encode user-supplied data whenever you build requests to a back-end service or include it in links.

How Vooki Pro helps

• Tests for HTTP parameter pollution.
• Tests encoding tricks often combined with HPP, such as double URL encoding and Unicode normalisation.
• Detects when a WAF blocks part of the scan, so you know your real coverage.

Frequently asked questions

Why does HPP work?

Different components (WAF, framework, back end) may pick the first, last or all values of a duplicated parameter, so validation and use can disagree.

How do I prevent HPP?

Reject or normalise duplicate parameters consistently, and validate the exact value your application uses.

Related: HTTP request smuggling · Scanning applications behind a WAF or rate limits