What problem does it solve? Web stacks often parse duplicate HTTP parameters inconsistently: a WAF may read the first value while the backend framework reads the last, creating gaps that enable filter bypasses, SSRF, CSRF token confusion, and business-logic abuse. This Skill provides a systematic methodology to fingerprint parser behavior and exploit those disagreements during authorized security assessments. ## Core Features & Use Cases - Server Behavior Matrix: Reference table of how PHP, ASP.NET, JSP, Django, Flask, Express, Rack, Go, and others resolve duplicate keys (first, last, join, or array). - Payload Patterns: Ready-to-use duplicate-key, array-style, encoded-ampersand, nested-bracket, and JSON duplicate-key payloads for query strings, form bodies, and multipart data. - Attack Scenario Chains: Structured playbooks for HPP combined with WAF bypass, SSRF (validator vs fetcher URL split), CSRF token confusion, and numeric business-logic fields like price or amount. - Use Case: During an authorized pentest, you suspect a WAF inspects only the first id parameter while the PHP backend uses the last. Use the Skill's matrix and decision tree to confirm the split with id=1&id=2 ordering tests, then craft a bypass payload. ## Quick Start Ask the agent to test the target endpoint for HTTP parameter pollution by sending duplicate parameters and comparing how the WAF and backend interpret them.
