can pass inspection. Testing gateway-to-backend precedence gaps is a core part of the methodology."}},{"@type":"Question","name":"Does parameter pollution apply to GraphQL and WebSockets?","acceptedAnswer":{"@type":"Answer","text":"Yes. GraphQL is vulnerable through aliased queries, duplicate variables, and batch mutations that bypass rate limits. WebSockets can carry polluted parameters in the upgrade request URL or in duplicate keys within message payloads."}},{"@type":"Question","name":"How do I remediate HTTP parameter pollution?","acceptedAnswer":{"@type":"Answer","text":"Enforce consistent parameter handling across all layers, reject duplicates at the CDN or API gateway, and validate input with JSON Schema or OpenAPI definitions. Set explicit query parser settings in frameworks like Express and enforce GraphQL query complexity limits."}}]}]}

Verified:Website GitHub

offensive-parameter-pollution

Tests web applications for HTTP parameter pollution and duplicate-parameter parsing flaws.

Updated Sep 23, 2026

Search Tags:#penetration testing #web security #waf bypass #burp suite #hpp #http parameter pollution #duplicate parameters

One-click install

npx skills add https://github.com/ehadziabdic/WAgents --skill offensive-parameter-pollution-ehadziabdic

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: offensive-parameter-pollution
Source: https://github.com/ehadziabdic/WAgents/tree/main/opencode/skills/offensive-parameter-pollution
Command: npx skills add https://github.com/ehadziabdic/WAgents --skill offensive-parameter-pollution-ehadziabdic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web servers, frameworks, proxies, and WAFs each handle duplicate HTTP parameters differently, creating gaps attackers can exploit for authentication bypass, WAF evasion, and data manipulation. This Skill provides a structured checklist to systematically find and validate these parameter handling inconsistencies during authorized security testing. ## Core Features & Use Cases - Duplicate Parameter Testing: Methodology for URL, form, JSON, cookie, header, GraphQL, and WebSocket parameter pollution with framework-specific behavior notes (ASP.NET, PHP, Node.js, Flask, Spring). - Exploitation Patterns: Covers access control bypass, CSRF token pollution, SSRF augmentation, WAF bypass, and API gateway vs backend precedence confusion. - Use Case: During a web application penetration test, you discover an endpoint like /api/user?id=123. Use this Skill to test id=123&id=999, determine whether the gateway trusts the first value while the backend trusts the last, and demonstrate an IDOR vulnerability. ## Quick Start Use the parameter pollution skill to test the login and checkout endpoints of my staging web application for duplicate-parameter handling flaws.

Frequently Asked Questions about offensive-parameter-pollution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for HTTP parameter pollution vulnerabilities?▼

Send duplicate parameters with different values, such as param=value1&param=value2, and observe which value the application uses. Test URL query strings, POST bodies, JSON bodies, cookies, and headers, then document how each application layer handles the duplication.

What tools are used for parameter pollution testing?▼

Burp Suite Repeater and Intruder handle manual duplicate-parameter tests, while Param Miner discovers hidden parameters. OWASP ZAP provides HTTP fuzzing, and Schemathesis fuzzes OpenAPI-defined endpoints for duplicate-field handling.

How do different frameworks handle duplicate HTTP parameters?▼

ASP.NET, JSP, and Node.js Express typically use the first occurrence, PHP uses the last, Perl CGI concatenates values with commas, and Flask builds arrays. Express behavior changes with the qs parser setting, so verify the exact parser configuration.

Can parameter pollution bypass a WAF?▼

Yes, when the WAF inspects the first parameter value but the backend processes the last, a payload like q=safe&q=<script>alert(1)</script> can pass inspection. Testing gateway-to-backend precedence gaps is a core part of the methodology.

Does parameter pollution apply to GraphQL and WebSockets?▼

Yes. GraphQL is vulnerable through aliased queries, duplicate variables, and batch mutations that bypass rate limits. WebSockets can carry polluted parameters in the upgrade request URL or in duplicate keys within message payloads.

How do I remediate HTTP parameter pollution?▼

Enforce consistent parameter handling across all layers, reject duplicates at the CDN or API gateway, and validate input with JSON Schema or OpenAPI definitions. Set explicit query parser settings in frameworks like Express and enforce GraphQL query complexity limits.