What problem does it solve? Web applications and WAFs often handle duplicate HTTP parameters inconsistently, allowing attackers to bypass input validation, manipulate payment amounts, or hijack OAuth flows. This Skill systematically identifies how a target server processes duplicate parameters and detects exploitable HPP weaknesses during authorized security assessments. ## Core Features & Use Cases - Parameter Precedence Detection: Determines whether a server uses the first, last, concatenated, or array value when duplicate parameters are submitted across Apache, IIS, Tomcat, Node.js, and Flask stacks. - HPP Payload Testing: Runs duplicate-parameter, encoding-bypass, and array-syntax payload suites against GET and POST endpoints, flagging response anomalies against a baseline. - WAF Bypass Verification: Tests five evasion techniques (direct, duplicate-first, duplicate-last, encoded, array) to check whether split payloads evade WAF filtering. - Use Case: During an authorized assessment of an e-commerce checkout flow, use the Skill to submit duplicate price parameters and confirm whether the server honors the attacker-controlled value, then document the finding with severity and remediation guidance. ## Quick Start Run the agent script against an authorized target URL to test parameter precedence and HPP payloads, for example by asking the agent to test http://testsite.local/api for HTTP parameter pollution vulnerabilities.
