offensive-parameter-pollution

Name: offensive-parameter-pollution
Author: SnailSploit

2.8kstars447forks

How to install offensive-parameter-pollution?

snailsploit/claude-red/offensive-parameter-pollution

$npx -y skills add SnailSploit/Claude-Red --skill offensive-parameter-pollution

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: HTTP Parameter Pollution (HPP)
2
3	## Metadata
4	- Skill Name: parameter-pollution
5	- Folder: offensive-parameter-pollution
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/parameter-pollution.md
7
8	## Description
9	HTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`parameter pollution, HTTP parameter pollution, HPP, duplicate parameter, WAF bypass, parsing differences, server-side HPP, client-side HPP, parameter injection`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# HTTP Parameter Pollution (HPP)
29
30	## Mechanisms
31
32	HTTP Parameter Pollution (HPP) is a web attack technique that exploits how web applications and servers handle multiple occurrences of the same parameter name. When a web application receives duplicate parameters, different technologies process them differently:
33
34	```mermaid
35	flowchart TD
36	subgraph "HTTP Parameter Pollution"
37	A[Multiple occurrences of same parameter] --> B{Server Technology}
38	B -->\|ASP.NET/IIS\| C[Uses first occurrence]
39	B -->\|PHP/Apache\| D[Uses last occurrence]
40	B -->\|JSP/Tomcat\| E[Uses first occurrence]
41	B -->\|Perl CGI\| F[Concatenates with comma]
42	B -->\|Python/Flask\| G[Builds array of values]
43	B -->\|Node.js/Express\| H[Uses first occurrence]
44	end
45	```
46
47	### Parameter Handling Behaviors
48
49	- ASP.NET/IIS: Uses the first occurrence of the parameter
50	- PHP/Apache: Uses the last occurrence of the parameter
51	- JSP/Tomcat: Uses the first occurrence of the parameter
52	- Perl CGI/Apache: Concatenates all occurrences with a comma delimiter
53	- Python/Flask: Builds an array of values
54	- Node.js/Express: Uses the first occurrence by default
55
56	### Notes and modern caveats
57
58	- Node.js `express` uses either `querystring` (first-wins) or `qs` (arrays/last-wins). `app.set('query parser', 'extended')` changes behavior. Many middlewares assume `param[]=a&param[]=b` for arrays; duplicates without `[]` can produce surprising results.
59	- Spring MVC/Spring Boot binders often collect duplicates into lists; API gateways (Kong, APIGEE, NGINX, Cloudflare) may collapse/normalize differently than backends.
60	- JSON duplicate keys: most parsers accept last-wins; some gateways reject duplicates while backends accept, creating precedence gaps.
61	- Cookies: duplicate cookie names and comma/semicolon handling vary by proxies/agents.
62
63	HPP attacks leverage these inconsistencies in parameter handling across application layers, servers, proxies, and frameworks. Two main types of HPP exist:
64
65	1. Server-side HPP: Exploiting the server's handling of multiple parameters
66	2. Client-side HPP: Manipulating parameters that are later processed by client-side code
67
68	## Hunt
69
70	### Identifying HPP Vulnerabilities
71
72	```mermaid
73	sequenceDiagram
74	participant Attacker
75	participant WebApp
76	participant Backend
77
78	Attacker->>WebApp: Request with duplicate parameter<br/>param=safe&param=malicious
79	Note over WebApp: Layer 1 processes first value
80	WebApp->>Backend: Forward request to backend
81	Note over Backend: Layer 2 processes last value
82	Backend->>WebApp: Process with malicious value
83	WebApp->>Attacker: Response
84	```
85
86	#### Testing Parameter Handling
87
88	1. Identify forms and request parameters
89	2. Test duplicate parameters with different values:
90
91	```
92	// Original request
93	https://example.com/search?param=value1
94
95	// Test request
96	https://example.com/search?param=value1&param=value2
97	```
98
99	3. Observe application behavior
100	4. Identify which value is used (first, last, concatenated)
101
102	#### Vulnerable Scenarios
103
104	- Parameter Overriding: Search for places where parameters might be overridden
105	- Request Proxies: Applications forwarding requests to other services
106	- Query String Processing: Applications that process query strings manually
107	- Multiple-Layer Processing: Applications where parameters pass through multiple layers
108	- OAuth/SAML Flows: Authentication flows where parameters may be manipulated
109
110	### Testing Techniques
111
112	#### URL Parameter Pollution
113
114	```
115	# Original URL
116	https://target.com/page?parameter=original_value
117
118	# Polluted URL
119	https://target.com/page?parameter=original_value&parameter=malicious_value
120	```
121
122	#### Form Parameter Pollution
123
124	1. Intercept a legitimate form submission
125	2. Add duplicate parameters with different values:
126
127	```
128	// Original POST body
129	parameter=original_value
130
131	// Modifi

People who liked this also viewed

6 picks

Type

offensive-parameter-pollution

2.8kstars447forks

View on GitHub

How to install offensive-parameter-pollution?

snailsploit/claude-red/offensive-parameter-pollution

$npx -y skills add SnailSploit/Claude-Red --skill offensive-parameter-pollution

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: HTTP Parameter Pollution (HPP)
2
3	## Metadata
4	- Skill Name: parameter-pollution
5	- Folder: offensive-parameter-pollution
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/parameter-pollution.md
7
8	## Description
9	HTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`parameter pollution, HTTP parameter pollution, HPP, duplicate parameter, WAF bypass, parsing differences, server-side HPP, client-side HPP, parameter injection`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# HTTP Parameter Pollution (HPP)
29
30	## Mechanisms
31
32	HTTP Parameter Pollution (HPP) is a web attack technique that exploits how web applications and servers handle multiple occurrences of the same parameter name. When a web application receives duplicate parameters, different technologies process them differently:
33
34	```mermaid
35	flowchart TD
36	subgraph "HTTP Parameter Pollution"
37	A[Multiple occurrences of same parameter] --> B{Server Technology}
38	B -->\|ASP.NET/IIS\| C[Uses first occurrence]
39	B -->\|PHP/Apache\| D[Uses last occurrence]
40	B -->\|JSP/Tomcat\| E[Uses first occurrence]
41	B -->\|Perl CGI\| F[Concatenates with comma]
42	B -->\|Python/Flask\| G[Builds array of values]
43	B -->\|Node.js/Express\| H[Uses first occurrence]
44	end
45	```
46
47	### Parameter Handling Behaviors
48
49	- ASP.NET/IIS: Uses the first occurrence of the parameter
50	- PHP/Apache: Uses the last occurrence of the parameter
51	- JSP/Tomcat: Uses the first occurrence of the parameter
52	- Perl CGI/Apache: Concatenates all occurrences with a comma delimiter
53	- Python/Flask: Builds an array of values
54	- Node.js/Express: Uses the first occurrence by default
55
56	### Notes and modern caveats
57
58	- Node.js `express` uses either `querystring` (first-wins) or `qs` (arrays/last-wins). `app.set('query parser', 'extended')` changes behavior. Many middlewares assume `param[]=a&param[]=b` for arrays; duplicates without `[]` can produce surprising results.
59	- Spring MVC/Spring Boot binders often collect duplicates into lists; API gateways (Kong, APIGEE, NGINX, Cloudflare) may collapse/normalize differently than backends.
60	- JSON duplicate keys: most parsers accept last-wins; some gateways reject duplicates while backends accept, creating precedence gaps.
61	- Cookies: duplicate cookie names and comma/semicolon handling vary by proxies/agents.
62
63	HPP attacks leverage these inconsistencies in parameter handling across application layers, servers, proxies, and frameworks. Two main types of HPP exist:
64
65	1. Server-side HPP: Exploiting the server's handling of multiple parameters
66	2. Client-side HPP: Manipulating parameters that are later processed by client-side code
67
68	## Hunt
69
70	### Identifying HPP Vulnerabilities
71
72	```mermaid
73	sequenceDiagram
74	participant Attacker
75	participant WebApp
76	participant Backend
77
78	Attacker->>WebApp: Request with duplicate parameter<br/>param=safe&param=malicious
79	Note over WebApp: Layer 1 processes first value
80	WebApp->>Backend: Forward request to backend
81	Note over Backend: Layer 2 processes last value
82	Backend->>WebApp: Process with malicious value
83	WebApp->>Attacker: Response
84	```
85
86	#### Testing Parameter Handling
87
88	1. Identify forms and request parameters
89	2. Test duplicate parameters with different values:
90
91	```
92	// Original request
93	https://example.com/search?param=value1
94
95	// Test request
96	https://example.com/search?param=value1&param=value2
97	```
98
99	3. Observe application behavior
100	4. Identify which value is used (first, last, concatenated)
101
102	#### Vulnerable Scenarios
103
104	- Parameter Overriding: Search for places where parameters might be overridden
105	- Request Proxies: Applications forwarding requests to other services
106	- Query String Processing: Applications that process query strings manually
107	- Multiple-Layer Processing: Applications where parameters pass through multiple layers
108	- OAuth/SAML Flows: Authentication flows where parameters may be manipulated
109
110	### Testing Techniques
111
112	#### URL Parameter Pollution
113
114	```
115	# Original URL
116	https://target.com/page?parameter=original_value
117
118	# Polluted URL
119	https://target.com/page?parameter=original_value&parameter=malicious_value
120	```
121
122	#### Form Parameter Pollution
123
124	1. Intercept a legitimate form submission
125	2. Add duplicate parameters with different values:
126
127	```
128	// Original POST body
129	parameter=original_value
130
131	// Modifi

People who liked this also viewed

6 picks

Type