skills.rest
erkanrzgc
erkanrzgcCOMMUNITY
Explore all skills by this author →
Website𝕏@erkan_rzgcGitHub

parameter-pollution

Identify and validate HTTP Parameter Pollution risks by mapping duplicate parameter interpretation.

1|1|Updated Mar 4, 2026
Search Tags:#web-security#pentest#vulnerability-testing#parameter-handling#security-research#hpp#http-parameter-pollution
One-click install
npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill parameter-pollution-erkanrzgc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: parameter-pollution
Source: https://github.com/erkanrzgc/cyberm4fia-scanner/tree/main/core/ai_skills/offensive-parameter-pollution
Command: npx skills add https://github.com/erkanrzgc/cyberm4fia-scanner --skill parameter-pollution-erkanrzgc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

HPP vulnerabilities arise when applications treat duplicate parameters inconsistently, allowing data leakage, parameter override, or bypass of security controls.

Core Features & Use Cases

  • Provides a structured methodology to identify how different components interpret duplicate parameters across URLs, forms, headers, and cookies.
  • Covers server-side and client-side handling, common frameworks, and real-world exploitation patterns.
  • Useful for security testers conducting web application pentests, API assessments, and security research.

Quick Start

Begin by enumerating all parameters and applying duplicate-parameter tests across the URL, form submissions, and headers to observe how values are interpreted by each component.

Frequently Asked Questions about parameter-pollution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is HTTP Parameter Pollution and how does it impact web application security?▼

HTTP Parameter Pollution (HPP) occurs when web applications inconsistently interpret duplicate parameters, allowing attackers to override values, bypass security controls, or cause data leakage across URLs, forms, and headers.

How do I test for HPP vulnerabilities across URLs, forms, and headers?▼

Enumerate all application parameters and apply duplicate-parameter tests across URLs, form submissions, cookies, and headers to observe how each component interprets the conflicting values and map the behavior.

Can I use this methodology to test APIs and proxy middleware for parameter override risks?▼

Yes, the testing methodology applies to web apps, APIs, proxies, and middleware across major frameworks, validating how duplicate parameters are interpreted by each distinct component in the request chain.

What is the best way to document HPP testing results for security remediation?▼

Follow a methodical testing workflow that records parameter behavior and documents the results, mapping exactly how duplicate parameters are interpreted by each component to provide clear guidance for remediation.

Why does my web app behave differently when duplicate HTTP parameters are sent?▼

Different components like proxies, middleware, and frameworks interpret duplicate parameters inconsistently, with some taking the first value and others the last, creating exploitable HPP vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl
2

jwt-oauth-token-attacks

Test JWT and OAuth token validation for signature and flow weaknesses.

Community
Advanced
mprycmpryc

diagnose-with-must-gather

Collects and analyzes OADP must-gather diagnostic data to identify issues.

Community
Intermediate
amano--amano--

burp-suite

Intercept HTTP traffic and test web applications for security vulnerabilities.

Community
Advanced
utsavthakurutsavthakur

http-parameter-pollution

Detect HTTP Parameter Pollution vulnerabilities by comparing duplicate parameter handling across server layers.

Community
Intermediate