skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

http-parameter-pollution

Identify HTTP parameter pollution vulnerabilities from inconsistent duplicate parameter parsing.

96|1|Updated Jun 4, 2026
Search Tags:#web-security#csrf#penetration-testing#ssrf#waf-bypass#hpp#http-parameter-pollution
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill http-parameter-pollution-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: http-parameter-pollution
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/http-parameter-pollution
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill http-parameter-pollution-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

HTTP Parameter Pollution (HPP) exploits inconsistent parsing of duplicate query or body parameters across different system layers (CDNs, WAFs, reverse proxies, application frameworks, business code), creating security gaps that attackers can leverage for filter bypasses, SSRF, CSRF token confusion, logic abuse, and other vulnerabilities.

Core Features & Use Cases

  • Layer Parsing Matrix: Includes a pre-built reference of how common technology stacks (PHP, ASP.NET, JSP, Django, Flask, Express, etc.) parse duplicate parameters, helping testers predict how different layers will interpret conflicting values.
  • Pre-Validated Payloads: Provides ready-to-use payloads for basic duplicate keys, array-style parameters, nested bracket keys, encoded ampersand edge cases, and JSON duplicate key parsing differences.
  • Attack Scenario Templates: Documents step-by-step workflows for HPP-powered WAF bypass, SSRF via split URL interpretation, CSRF token confusion, and business logic abuse (e.g., tampering with payment amounts or quantities via duplicate numeric fields).
  • Use Case: A penetration tester can use this skill to identify and exploit gaps where a WAF inspects a benign first parameter value while the backend application processes a malicious second value, bypassing input filters entirely.

Quick Start

Use the http-parameter-pollution skill to test a target web application for HTTP parameter pollution vulnerabilities by sending duplicate parameter payloads and comparing how the front-end WAF and back-end application parse the values to identify filter bypass opportunities.

Frequently Asked Questions about http-parameter-pollution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is HTTP parameter pollution and how does it bypass WAF rules?▼

HTTP parameter pollution (HPP) bypasses WAF rules by sending duplicate query or POST parameters, exploiting inconsistent parsing between the WAF and backend application frameworks so the filter inspects a benign value while the app processes a malicious one.

How do I test for duplicate HTTP parameter vulnerabilities across different web frameworks?▼

To test for duplicate HTTP parameter vulnerabilities, send duplicate parameter payloads via query strings, POST form data, or JSON bodies, then compare how different web frameworks like PHP, ASP.NET, Django, or Flask parse the conflicting values.

Can HTTP parameter pollution be used for SSRF and CSRF token confusion?▼

Yes, HTTP parameter pollution can be used for SSRF and CSRF token confusion by manipulating split URL interpretation or injecting duplicate parameters to confuse token validation logic across reverse proxies and application layers.

How do different technology stacks parse duplicate query string parameters?▼

Different technology stacks parse duplicate query string parameters inconsistently; for example, some frameworks take the first value, others take the last, and some return an array, creating exploitable gaps between CDN, WAF, and backend interpretations.

What payloads are used for HTTP parameter pollution attacks in penetration testing?▼

Common HTTP parameter pollution payloads include basic duplicate keys, array-style parameters, nested bracket keys, encoded ampersand edge cases, and JSON duplicate keys to test parsing differences and bypass input filters during authorized penetration testing.

Does HTTP parameter pollution work on JSON request bodies and multipart form data?▼

Yes, HTTP parameter pollution works on JSON request bodies and multipart form data by exploiting duplicate key parsing differences across application frameworks, allowing testers to target business logic abuse and input validation bypasses beyond standard query strings.

Related Skills

Explore More Software Engineering Skills→
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
SnailSploitSnailSploit
2.9k

parameter-pollution

Analyze server-side and client-side parameter parsing to exploit HTTP Parameter Pollution vulnerabilities.

Community
Advanced
ok-helloworldok-helloworld
241

http-parameter-pollution

Detect HTTP parameter pollution by fingerprinting duplicate-key parsing across request layers.

Community
Advanced
HacktronAIHacktronAI
112

waf-bypass-hunter

Test payload variants against a Go WAF and Node.js backend to discover parser-differential bypasses.

Official
Advanced