Agent skill · security · yaklang
http-parameter-pollution
HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.
Why this skill is useful
Provides detailed knowledge on HTTP Parameter Pollution attack vectors and server behavior that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: HTTP Parameter Pollution (HPP) AI LOAD INSTRUCTION: Model the full request path: browser → CDN/WAF → reverse proxy → app framework → business code. Duplicate keys (a=1&a=2) are not an error at HTTP level; each hop may pick first, last, join, or array-ify. Test HPP when WAF and app disagree, or when internal HTTP clients rebuild query strings. Routing note: when the same parameter appears multiple times, or WAF/backend stacks differ, use the Section 1 matrix to test first/last/merge assumptions, then design Section 3 scenario chains. 0. QUICK START Hypothesis: the security check reads one occurrence of a parameter while the action reads another. First-pass payloads Body variants (repeat for POST) Quick methodology 1. Fingerprint front stack (CDN/WAF) vs origin (language/framework) using baseline a=1&a=2. 2. Send both orders: a=1&a=2 and a=2&a=1 (some parsers are order-sensitive). 3. If JSON: test duplicate keys and Content-Type confusion (see Section 2). --- 1. SERVER BEHAVIOR MATRIX Typical defaults — always confirm; middleware and custom parsers override these. Technology Behavior Example: a=1&a=2 --- --- --- PHP / Apache ($GET) Last occurrence a=2 ASP.NET / IIS Often comma-joined (all) a=1,2 JSP / Tomcat (servlet param) First occurrence a=1 Python / Django (QueryDict) Last occurrence a=2 Python / Flask (request.args) First occurrence a=1 Node.js / Express (req.query) Array of values a=['1','2'] (shape may vary by parser version) Perl / CGI First occurrence a=1 Ruby / Rack (Rack::Utils) Last occurrence a=2 Go net/http (ParseQuery) First occurrence a=1 Why it matters: a WAF on IIS might see 1,2 while PHP backend receives 2 only — or the reverse if a proxy normalizes. --- 2. PAYLOAD PATTERNS 2.1 Basic duplicate key 2.2 Array-style (PHP / some frameworks) 2.3 Mixed array + scalar 2.4 Encoded ampersand (parser differential) 2.5 Nested / bracket keys 2.6 JSON duplicate keys Many parsers keep last key; some keep first. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/http-parameter-pollution