Advanced Web, API & Modern Stack

Parameter Pollution & Rate-Limit Bypass

Duplicate params, type juggling, and tricks to slip past limits.

Intermediate · 11 min

Open the interactive lesson →

Small parsing quirks create real bugs. HTTP Parameter Pollution (HPP) sends the same parameter twice; different components pick different values, enabling filter bypasses and logic confusion.

GET /transfer?amount=10&amount=10000
# Front-end validates the first, back-end uses the last (or vice-versa).

• HPP — duplicate params; test which value each layer trusts.
• Type juggling — sending an array or object where a string is expected (see NoSQL & prototype pollution).
• Rate-limit bypass — rotate IPs via X-Forwarded-For, change casing/encoding of the endpoint, or use HTTP/2 multiplexing / request batching.
• Case & encoding tricks — /Admin vs /admin, URL-encoding, trailing dots/slashes to dodge filters.

Take the quiz →