HPP Hunter

HTTP Parameter Pollution (HPP) exploits how different server technologies handle duplicate HTTP parameters in inconsistent ways. The same request can be interpreted differently by a WAF, a front-end proxy, and a back-end application — creating bypasses, logic flaws, and privilege escalation paths.

Phase 1 — Fingerprint Parameter Handling

Before testing anything, determine how the target processes duplicate parameters. This governs every attack that follows.

Manual fingerprint

GET /search?color=red&color=blue

Check which value appears in the response: