HTTP Parameter Pollution · passage 4 of 4

Parameter Pollution Payloads

Text · HTTP Parameter Pollution/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

* Duplicate Parameters: ```ps1 param=value1&param=value2 ``` * Array Injection: ```ps1 param[]=value1 param[]=value1&param[]=value2 param[]=value1&param=value2 param=value1&param[]=value2 ``` * Encoded Injection: ```ps1 param=value1%26other=value2 ``` * Nested Injection: ```ps1 param[key1]=value1&param[key2]=value2 ``` * JSON Injection: ```ps1 { "test": "user", "test": "admin" } ```

Every one of the 4 is a mark on the map. Named now: 1 to 4, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.