# Security Control Differential Testing

Find security-relevant interpretation gaps between layers - client, CDN, WAF, reverse...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill security-control-differential-testing -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill security-control-differential-testing -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill security-control-differential-testing -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill security-control-differential-testing -g -a gemini-cli -y`

## Description

Find security-relevant interpretation gaps between layers - client, CDN, WAF, reverse proxy, API gateway, application, framework - using path normalization, method, encoding, header, and version differentials. The goal is a control that one layer honors and another ignores, not generic WAF bypass.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Control Differential Testing

## Purpose

Requests pass through a stack - client, CDN, WAF, reverse proxy, API gateway, application, framework/router - and each layer interprets the SAME bytes slightly differently. A security control enforced at one layer but not another is a bypass. This skill hunts the differentials that CHANGE a security outcome, pairing each experiment with a control request so differences are attributable.

## The Layer Model

```text
Client -> CDN -> WAF -> reverse proxy -> API gateway -> application -> framework/router
```

Determine which layers exist first (response headers, Server/Via/X-Cache hints, cookie domains, error pages, timing on block). Not every target has every layer; test the handoffs you actually observe.

## Differential Experiments

Each experiment: send the CONTROL (canonical request) and the VARIANT; compare status, headers, body, and - critically - the OUTCOME (was the operation performed?). Use an operation you can verify server-side (an object read/write you can re-fetch).

### Path interpretation
- Trailing dot: `/admin.` vs `/admin`; trailing slash; double slashes `//admin`
- Encoded slash: `%2fadmin`, double-encoded `%252fadmin`
- Semicolon/matrix params: `/public;/../admin`, `/admin;x=1`
- Dot-segments: `/public/../admin`
- Case variation: `/ADMIN`, `/AdMiN`
- Unicode normalization: `/adm%u0069n` where the platform normalizes

### Method interpretation
- Verb swap: gateway authorizes GET, backend accepts POST/PUT/PATCH/DELETE on the same path
- Override headers: X-HTTP-Method-Override, X-Original-Method, X-Method-Override
- HEAD/POST bodies, OPTIONS leaks, arbitrary verbs (FOO) that fall through to route handlers
- Content-Type change: application/json vs form-encoded vs text/plain vs multipart delivering the same operation

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/application-security/security-control-differential-testing/SKILL.md