HTTP Parameter Pollution (HPP) Testing Checklist

1. Identify Input Parameters

• Identify all GET parameters.
• Identify all POST parameters.
• Identify JSON body parameters.
• Identify XML parameters.
• Identify multipart/form-data parameters.
• Identify GraphQL variables.
• Identify hidden form parameters.
• Identify URL path parameters converted into query parameters.
• Identify REST API query parameters.
• Identify authentication-related parameters.
• Identify authorization parameters.
• Identify callback/redirect parameters.
• Identify search/filter/sort parameters.
• Identify pagination parameters.
• Identify file upload parameters.

2. Basic Parameter Duplication

• Duplicate GET Parameter: ?id=1&id;=2
• Check whether first value is used.
• Check whether last value is used.
• Check whether values are concatenated.
• Check whether both values are processed.
• Check for application errors.
• Duplicate POST Parameter: username=admin & username=user
• Observe which value reaches backend.
• Duplicate JSON Key: {“name”:”admin”,”name”:”guest”}
• Check parser behavior.
• Duplicate Cookie: role=user; role=admin
• Check privilege escalation.

3. Different Parameter Separators

• Try &, ;, %26, %3B, &&
• Examples: ?id=1&id;=2, ?id=1;id=2, ?id=1%26id=2, ?id=1&&id;=2
• Observe parser differences.

4. Empty Parameter Pollution- ?id=1&id;=

• ?id=&id;=1
• ?id=
• Check validation bypass.

5. Null Parameter Pollution

• ?id=null&id;=1
• ?id=%00&id;=1
• ?id=undefined&id;=1

6. Array Style Pollution

• id[]=1&id;[]=2
• id[0]=1&id;[1]=2
• id[]=1&id;=2
• id=1&id;[]=2
• Observe backend parsing.