Http Parameter Pollution

When the WAF sees one value but your app framework picks a different one from the same parameter name, you've got an HTTP Parameter Pollution vector. This skill walks Claude through the parser behavior matrix (PHP takes last, Flask takes first, IIS joins with commas) and chains that into WAF bypasses, SSRF splits, and business logic abuse. The decision tree and attack templates are concrete enough to drive actual testing. Honest take: HPP is niche but devastating when stacks disagree, and having the server behavior reference beats guessing which occurrence wins. Just keep it scoped since duplicate amount or price parameters can trigger real transactions.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill http-parameter-pollution --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: HTTP Parameter Pollution (HPP)

AI LOAD INSTRUCTION: Model the full request path: browser → CDN/WAF → reverse proxy → app framework → business code. Duplicate keys (a=1&a=2) are not an error at HTTP level; each hop may pick first, last, join, or array-ify. Test HPP when WAF and app disagree, or when internal HTTP clients rebuild query strings. Routing note: when the same parameter appears multiple times, or WAF/backend stacks differ, use the Section 1 matrix to test first/last/merge assumptions, then design Section 3 scenario chains.

0. QUICK START

Hypothesis: the security check reads one occurrence of a parameter while the action reads another.

First-pass payloads

id=1&id=2
id=1&id=1%20OR%201=1
url=https://legit.example&id=https://evil.example
amount=1&amount=9999
csrf=TOKEN_A&csrf=TOKEN_B
user=alice&user=admin

Body variants (repeat for POST)

application/x-www-form-urlencoded
id=1&id=2

multipart/form-data
------boundary
Content-Disposition: form-data; name="id"
1
------boundary
Content-Disposition: form-data; name="id"
2