What problem does it solve? Web applications often parse duplicate HTTP parameters differently at the frontend, gateway, and backend layers, creating validation, filtering, or authorization inconsistencies that are hard to detect with standard testing. This Skill provides a structured, evidence-gated methodology to safely verify HTTP parameter pollution (HPP) behavior on authorized targets. ## Core Features & Use Cases - Multi-Layer Parser Modeling: Maps how each layer (URL query, form body, JSON, path/matrix parameters) handles duplicate parameters — first-wins, last-wins, array, merge, or reject. - Controlled Single-Variable Probing: Follows a baseline → single-variable probe → post-baseline → oracle → evidence workflow, adding only one duplicate parameter per experiment. - Strict Oracle and Stop Conditions: Distinguishes real findings (divergent value selection causing repeatable semantic changes) from false positives like normal array behavior or UI display differences. - Use Case: During an authorized assessment, you suspect a reverse proxy and backend disagree on duplicate role parameters. Use this Skill to build a parser model, run minimal safe probes on your own test account, and capture layered evidence with rollback. ## Quick Start Ask the agent to run the HTTP parameter pollution hunt against my authorized test target and verify whether duplicate parameters cause inconsistent validation between the proxy and backend.
