Summary
When the WAF sees one value but your app framework picks a different one from the same parameter name, you've got an HTTP Parameter Pollution vector. This skill walks Claude through the parser behavior matrix (PHP takes last, Flask takes first, IIS joins with commas) and chains that into WAF bypasses, SSRF splits, and business logic abuse. The decision tree and attack templates are concrete enough to drive actual testing. Honest take: HPP is niche but devastating when stacks disagree, and having the server behavior reference beats guessing which occurrence wins. Just keep it scoped since duplicate amount or price parameters can trigger real transactions.
Install to Claude Code
npx -y skills add yaklang/hack-skills --skill http-parameter-pollution --agent claude-codeInstalls into .claude/skills of the current project.
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →
Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →Files
SKILL.md
Select a file.
Featured
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Plug Mailtrap into your AI workflow and let it handle the email.
Connect Mailtrap MCP →Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.
Try For Free →Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.
Try For Free →Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
