SKILL: HTTP Parameter Pollution (HPP) AI LOAD INSTRUCTION : Model the full request path : browser → CDN/WAF → reverse proxy → app framework → business code. Duplicate keys ( ) are not an error at HTTP level; each hop may pick first, last, join, or array-ify. Test HPP when WAF and app disagree, or when internal HTTP clients rebuild query strings. Routing note: when the same parameter appears multiple times, or WAF/backend stacks differ, use the Section 1 matrix to test first/last/merge assumptions, then design Section 3 scenario chains. 0. QUICK START Hypothesis : the security check reads one…