offensive-parameter-pollution

SKILL: HTTP Parameter Pollution (HPP)

Metadata

• Skill Name: parameter-pollution
• Folder: offensive-parameter-pollution
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/parameter-pollution.md

Description

HTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.

Trigger Phrases

Use this skill when the conversation involves any of: parameter pollution, HTTP parameter pollution, HPP, duplicate parameter, WAF bypass, parsing differences, server-side HPP, client-side HPP, parameter injection

Instructions for Claude

When this skill is active:

1. Load and apply the full methodology below as your operational checklist
2. Follow steps in order unless the user specifies otherwise
3. For each technique, consider applicability to the current target/context
4. Track which checklist items have been completed
5. Suggest next steps based on findings

---

Full Methodology

HTTP Parameter Pollution (HPP)

Mechanisms

HTTP Parameter Pollution (HPP) is a web attack technique that exploits how web applications and servers handle multiple occurrences of the same parameter name. When a web application receives duplicate parameters, different technologies process them differently:

flowchart TD
    subgraph "HTTP Parameter Pollution"
    A[Multiple occurrences of same parameter] --> B{Server Technology}
    B -->|ASP.NET/IIS| C[Uses first occurrence]
    B -->|PHP/Apache| D[Uses last occurrence]
    B -->|JSP/Tomcat| E[Uses first occurrence]
    B -->|Perl CGI| F[Concatenates with comma]
    B -->|Python/Flask| G[Builds array of values]
    B -->|Node.js/Express| H[Uses first occurrence]
    end

Parameter Handling Behaviors

• ASP.NET/IIS: Uses the first occurrence of the parameter
• PHP/Apache: Uses the last occurrence of the parameter
• JSP/Tomcat: Uses the first occurrence of the parameter
• Perl CGI/Apache: Concatenates all occurrences with a comma delimiter
• Python/Flask: Builds an array of values
• Node.js/Express: Uses the first occurrence by default