Your incoming string, as Gerben has mentioned, will actually be more like:

GET /STA/ID=HelloWorld/Pass=Testin123 HTTP/1.1

My personal preferred method is to use strtok() to split the string up. I'd use a two-pass method for this.

First split the string up into three parts - one GET, one the request, and the third the request type (though you don't need to use that for anything). Assume the string is in C string incoming:

char *get = strtok(incoming, " ");
char *request = strtok(NULL, " ");
char *rtype = strtok(NULL, " ");

The request is now pointed to by the *request pointer and the string has been sliced up in-place. So now you can do something similar with the request, this time splitting on / instead of space:

String SSID;
String Pass;

if (request != NULL) {
    char *part = strtok(request, "/");
    while (part) { // While there is a section to process...
        if (!strncmp(part, "ID=", 3)) { // We have the ID
            SSID = String(part + 3);
        } else if (!strncmp(part, "Pass=", 5)) { // We have the password
            Pass = String(part + 5);
        }
        part = strtok(NULL, "/");
    }
}

Your incoming string, as Gerben has mentioned, will actually be more like:

GET /STA/ID=HelloWorld/Pass=Testin123 HTTP/1.1

My personal preferred method is to use strtok() to split the string up. I'd use a two-pass method for this.

First split the string up into three parts - one GET, one the request, and the third the request type (though you don't need to use that for anything). Assume the string is in C string incoming:

char *get = strtok(incoming, " ");
char *request = strtok(NULL, " ");
char *rtype = strtok(NULL, " ");

The request is now pointed to by the *request pointer and the string has been sliced up in-place. So now you can do something similar with the request, this time splitting on / instead of space:

String SSID;
String Pass;

if (request != NULL) {
    char *part = strtok(request, "/"); 

    bool seenSTA = false;
    while (part) { // While there is a section to process...

        if (seenSTA) {
            if (!strncmp(part, "ID=", 3)) { // We have the ID
                SSID = String(part + 3);
            } else if (!strncmp(part, "Pass=", 5)) { // We have the password
                Pass = String(part + 5);
            }
        } else if (!strcmp(part, "STA")) { 
            seenSTA = true;
        }

        part = strtok(NULL, "/");
    }
}