post-parameter-tester

name	post-parameter-tester
description	Test POST parameters for SQL injection, XSS, and command injection vulnerabilities. Use when testing web application forms and API endpoints for common injection flaws.

POST Parameter Security Tester

Comprehensive security testing framework for POST parameters, supporting form-encoded and JSON payloads.

Features

• SQL Injection Testing: Error-based, Boolean-based, Time-based detection
• XSS Testing: Reflected XSS with multiple payload types
• Command Injection: OS command execution detection via time delays and output
• IDOR Testing: Parameter manipulation and access control bypass
• JSON Support: Native JSON POST body testing
• Evidence Collection: Captures full request/response for manual verification
• Baseline Comparison: Detects anomalies by comparing normal vs malicious responses

Architecture

post-parameter-tester/
├── SKILL.md                 # This file - AgentSkills.io spec
├── scripts/
│   ├── test-post.sh        # Main entry point - orchestrates testing
│   ├── sqli-tester.sh      # SQL injection detection
│   ├── xss-tester.sh       # Cross-site scripting detection
│   ├── cmdi-tester.sh      # Command injection detection
│   └── analyze-response.sh # Response analysis and evidence extraction
├── references/
│   ├── PAYLOADS.md         # Payload library with references
│   └── ERROR_PATTERNS.md   # Known error patterns for detection
└── tests/
    └── test-suite.sh       # Integration tests

Usage

Basic Usage

# Test form-encoded POST
./scripts/test-post.sh https://example.com/login 'username=admin&password=test'

# Test JSON POST
./scripts/test-post.sh https://api.example.com/user \
  '{"id":1,"name":"test"}' \
  --content-type json

Advanced Usage

# Thorough SQL injection testing with authentication
./scripts/test-post.sh https://app.example.com/api/search \
  '{"query":"test","category":"all"}' \
  --content-type json \
  --cookie "PHPSESSID=abc123" \
  --test-type sqli \
  --depth thorough \
  --output /tmp/results.json

# Test specific parameter only
./scripts/test-post.sh https://example.com/search \
  '{"q":"test","filter":"all"}' \
  --parameter q \
  --test-type xss,sqli

Output Format

{
  "target": "https://example.com/login",
  "timestamp": "2026-03-16T09:00:00Z",
  "vulnerabilities": [
    {
      "type": "SQL Injection",
      "severity": "Critical",
      "parameter": "username",
      "payload": "' OR '1'='1",
      "evidence": {
        "method": "error-based",
        "error_message": "You have an error in your SQL syntax",
        "response_code": 200,
        "response_time_ms": 145
      },
      "url": "https://example.com/login",
      "confidence": "high"
       
       
    
  
   
     
     
      
       
     
  

Integration with Pentest Workflow

Step 1: Discover POST endpoints

# Use web-spider to find forms and API endpoints
/skills/pentest/web-spider/scripts/spider.sh https://example.com

Step 2: Test parameters

# Feed discovered endpoints to post-parameter-tester
cat endpoints.json | jq -r '.[] | select(.method=="POST") | .url' | \
  while read url; do
    ./scripts/test-post.sh "$url" --auto-extract
  done

Step 3: Deep-dive on findings

# Use sqlmap for confirmed SQL injection
sqlmap -u https://example.com/login \
  --data "username=test&password=test" \
  -p username \
  --batch

Roadmap

• Blind SQL injection with DNS exfiltration
• Stored XSS multi-pass verification
• GraphQL parameter testing
• XML injection (XXE) detection
• LDAP injection testing
• NoSQL injection (MongoDB, Redis)
• Parameter pollution testing
• Race condition detection

Contributing

Payloads improvements welcome! Add to references/PAYLOADS.md with:

• Payload string
• Vulnerability type
• Detection method
• Reference CVE/article

---

Next Steps:

1. Read references/PAYLOADS.md for payload details
2. Review scripts/test-post.sh for implementation
3. Run tests/test-suite.sh to verify installation