Security Control Differential Testing

Purpose

Requests pass through a stack - client, CDN, WAF, reverse proxy, API gateway, application, framework/router - and each layer interprets the SAME bytes slightly differently. A security control enforced at one layer but not another is a bypass. This skill hunts the differentials that CHANGE a security outcome, pairing each experiment with a control request so differences are attributable.

The Layer Model

Client -> CDN -> WAF -> reverse proxy -> API gateway -> application -> framework/router

Determine which layers exist first (response headers, Server/Via/X-Cache hints, cookie domains, error pages, timing on block). Not every target has every layer; test the handoffs you actually observe.

Differential Experiments

Each experiment: send the CONTROL (canonical request) and the VARIANT; compare status, headers, body, and - critically - the OUTCOME (was the operation performed?). Use an operation you can verify server-side (an object read/write you can re-fetch).

Path interpretation

• Trailing dot: /admin. vs /admin; trailing slash; double slashes //admin
• Encoded slash: %2fadmin, double-encoded %252fadmin
• Semicolon/matrix params: /public;/../admin, /admin;x=1
• Dot-segments: /public/../admin
• Case variation: /ADMIN, /AdMiN
• Unicode normalization: /adm%u0069n where the platform normalizes

Method interpretation

• Verb swap: gateway authorizes GET, backend accepts POST/PUT/PATCH/DELETE on the same path
• Override headers: X-HTTP-Method-Override, X-Original-Method, X-Method-Override
• HEAD/POST bodies, OPTIONS leaks, arbitrary verbs (FOO) that fall through to route handlers
• Content-Type change: application/json vs form-encoded vs text/plain vs multipart delivering the same operation