# Http Parameter Pollution

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by...

- Repository: https://github.com/Zyrexnn/Cybermes (987 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Zyrexnn/Cybermes --skill http-parameter-pollution -g -a claude-code -y`
Codex: `npx skills add Zyrexnn/Cybermes --skill http-parameter-pollution -g -a codex -y`
Cursor: `npx skills add Zyrexnn/Cybermes --skill http-parameter-pollution -g -a cursor -y`
Gemini CLI: `npx skills add Zyrexnn/Cybermes --skill http-parameter-pollution -g -a gemini-cli -y`

## Description

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: HTTP Parameter Pollution (HPP)

> **AI LOAD INSTRUCTION**: Model the **full request path**: browser → CDN/WAF → reverse proxy → app framework → business code. Duplicate keys (`a=1&a=2`) are not an error at HTTP level; each hop may pick first, last, join, or array-ify. Test HPP when WAF and app disagree, or when internal HTTP clients rebuild query strings. Routing note: when the same parameter appears multiple times, or WAF/backend stacks differ, use the Section 1 matrix to test first/last/merge assumptions, then design Section 3 scenario chains.

## 0. QUICK START

**Hypothesis**: the **security check** reads one occurrence of a parameter while the **action** reads another.

### First-pass payloads

```text
id=1&id=2
id=1&id=1%20OR%201=1
url=https://legit.example&id=https://evil.example
amount=1&amount=9999
csrf=TOKEN_A&csrf=TOKEN_B
user=alice&user=admin
```

### Body variants (repeat for POST)

```text
application/x-www-form-urlencoded
id=1&id=2

multipart/form-data
------boundary
Content-Disposition: form-data; name="id"
1
------boundary
Content-Disposition: form-data; name="id"
2
```

### Quick methodology

1. Fingerprint **front** stack (CDN/WAF) vs **origin** (language/framework) using baseline `a=1&a=2`.
2. Send **both** orders: `a=1&a=2` and `a=2&a=1` (some parsers are order-sensitive).
3. If JSON: test **duplicate keys** and Content-Type confusion (see Section 2).

---

## 1. SERVER BEHAVIOR MATRIX

Typical defaults, **always confirm**; middleware and custom parsers override these.

The rest: https://github.com/Zyrexnn/Cybermes/blob/HEAD/knowledge/hack-skills/skills/http-parameter-pollution/SKILL.md