skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

content-type-mime-diff

Detect XSS vulnerabilities from divergent MIME Content-Type parsing between browsers and server libraries.

11|1|Updated May 4, 2026
Search Tags:#xss#security testing#web security#server-side validation#content-type#browser parsing#mime parser differential
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill content-type-mime-diff
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: content-type-mime-diff
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/content-type-mime-diff
Command: npx skills add https://github.com/dreadnode/capabilities --skill content-type-mime-diff

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Divergent MIME Content-Type parsing logic between web browsers (which treat the header as list-based, last value wins) and server-side libraries (which treat it as singleton, first value wins) creates cross-site scripting (XSS) vulnerabilities in applications that validate the parsed Content-Type server-side but reflect the original unparsed header value in responses.

Core Features & Use Cases

  • Root Cause Breakdown: Explains the RFC 9110 specification conflict and parsing behavior differences across browsers and server-side libraries.
  • Payload Library: Includes tailored payloads for common Python (email.message, googleapiclient.mimeparse, werkzeug, cgi) and Node.js (whatwg-mimetype, content-type) MIME parsers to bypass validation checks.
  • Testing Framework: Provides step-by-step testing procedures, examples of vulnerable code patterns, and indicators of at-risk endpoints to streamline vulnerability identification.
  • Use Case: Security testers can leverage this skill during authorized web application assessments to identify XSS flaws arising from MIME parser differentials.

Quick Start

Use this skill to test a web endpoint that reflects user-controlled Content-Type header values for XSS via MIME parser differentials.

Frequently Asked Questions about content-type-mime-diff

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What causes MIME parser differential XSS vulnerabilities in web applications?▼

MIME parser differential XSS occurs when browsers and server-side libraries parse Content-Type headers differently, allowing attackers to bypass server-side validation by exploiting that browsers treat headers as list-based while servers treat them as singleton.

How do I test for Content-Type header XSS bypasses using Python and Node.js parsers?▼

Test by sending crafted Content-Type headers to endpoints that reflect unparsed input, using tailored payloads for Python libraries like werkzeug, email.message, and googleapiclient.mimeparse, or Node.js libraries like whatwg-mimetype and content-type.

When should I look for MIME parsing differentials during security testing?▼

Look for MIME parsing differentials when testing authorized web applications that validate Content-Type headers server-side but reflect original unparsed header values in response headers, especially endpoints accepting type, content-type, or format parameters.

Why do browsers and server-side MIME parsers handle Content-Type headers differently?▼

Browsers and server-side libraries handle Content-Type headers differently due to an RFC 9110 specification conflict, where browsers use list-based parsing with the last value winning while server-side libraries use singleton parsing with the first value winning.

Does this MIME differential testing approach work with both Python and Node.js web servers?▼

Yes, this approach works with both Python and Node.js web servers, providing specific payloads for common Python MIME parsers like email.message, werkzeug, and cgi, alongside Node.js parsers like whatwg-mimetype and content-type.

What are the limitations of exploiting Content-Type parsing differentials for XSS?▼

Limitations include requiring the target application to reflect unparsed Content-Type header values in responses while only validating the parsed value, meaning applications that sanitize reflected headers or do not echo input are not vulnerable.

Related Skills

Explore More Software Engineering Skills→
elementalsoulselementalsouls
3.3k

hunt-xss

Map XSS surfaces across web applications for safe testing and remediation.

Community
Advanced
RepairYourTechRepairYourTech
6

input-sanitization

Validate and sanitize server-side web input against injection and XSS threats.

Community
Advanced
amano--amano--

burp-suite

Intercept HTTP traffic and test web applications for security vulnerabilities.

Community
Advanced
AndyAnh174AndyAnh174

Cross-Site Scripting and HTML Injection Testing

Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities.

Community
Advanced