skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

http-parameter-pollution

Identify duplicate HTTP query and body key handling inconsistencies across components.

1.6k|204|Updated Apr 7, 2026
Search Tags:#web-security#pentest#security-testing#hpp#http-parameter-pollution#parameter-pollution
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill http-parameter-pollution
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: http-parameter-pollution
Source: https://github.com/yaklang/hack-skills/tree/main/skills/http-parameter-pollution
Command: npx skills add https://github.com/yaklang/hack-skills --skill http-parameter-pollution

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

HTTP Parameter Pollution (HPP) arises when servers, proxies, and application frameworks interpret duplicate query or body keys differently, enabling bypasses, logic abuse, or token confusion. This skill helps you identify and exploit divergent parameter handling to assess security gaps.

Core Features & Use Cases

  • Behavior mapping: understand how different stacks (CDNs, WAFs, app frameworks) treat duplicate keys across GET and POST.
  • Attack planning: design multi-hop scenarios (HPP + SSRF, CSRF, or business logic) to reveal misconfigurations.
  • Assessment playbooks: craft targeted payloads and test sequences to validate defense gaps in real systems.

Quick Start

Inspect a test request with duplicate parameters across URL and body, observe how downstream components interpret values, and document divergent behavior.

Frequently Asked Questions about http-parameter-pollution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is HTTP Parameter Pollution and how does it bypass web security controls?▼

HTTP Parameter Pollution (HPP) happens when servers, proxies, and frameworks interpret duplicate query or body keys differently, enabling attackers to bypass WAFs, manipulate logic, or confuse tokens during web security testing.

How do I test for duplicate HTTP query keys and parameter handling inconsistencies?▼

Inspect a test request with duplicate parameters across URL and body, then observe how downstream components like CDNs, WAFs, and app frameworks interpret the values to document divergent behavior and reveal misconfigurations.

Can I use parameter pollution payloads to bypass WAF and CDN protections?▼

Yes, by mapping how CDNs, WAFs, and app frameworks treat duplicate GET and POST keys, you can design HPP payloads to exploit cross-layer data flow inconsistencies and bypass proxy protections.

What is the best way to map server parsing order for duplicate HTTP parameters?▼

The best way to map server parsing order is to craft targeted payloads with duplicate query and body keys, observe how different stacks interpret values across GET and POST, and document the divergent behavior.

Does HTTP Parameter Pollution work with SSRF, CSRF, and business logic attacks?▼

Yes, HPP can be combined with SSRF, CSRF, or business logic abuse to design multi-hop attack scenarios that reveal security gaps and misconfigurations in real systems during API testing.

Related Skills

Explore More Software Engineering Skills→
sayseven7sayseven7
11

http-parameter-pollution

Detect HTTP parameter pollution from duplicate query or body keys.

Community
Advanced
yhy0yhy0
518

ssrf

Detect and exploit server-side request forgery vulnerabilities in URL parameters.

Community
Advanced
amano--amano--

burp-suite

Intercept HTTP traffic and test web applications for security vulnerabilities.

Community
Advanced
utsavthakurutsavthakur

http-parameter-pollution

Detect HTTP Parameter Pollution vulnerabilities by comparing duplicate parameter handling across server layers.

Community
Intermediate