Skip to content
Get packs

HTTP Parameter Pollution Checklist

Guides the agent through testing web apps for duplicate-parameter flaws and WAF bypasses

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

Once installed, the agent follows a structured checklist for HTTP parameter pollution (HPP), a web attack category where sending the same parameter name twice makes different servers, proxies, and frameworks pick different values. The agent will explain how each technology resolves duplicates, suggest test requests for URLs, forms, JSON, cookies, GraphQL and WebSockets, and discuss ways this can bypass web application firewalls. It is a methodology guide for security testing rather than a tool that attacks anything by itself.

Great for

  • Security testers preparing an authorised web application assessment
  • Students learning how parsing differences create vulnerabilities
  • Developers reviewing whether their API gateway and backend agree on parameter precedence

Skip it if

  • Testing systems you do not own or have written permission to test, since the content is framed around exploitation and could facilitate unauthorised access
  • Production sites without coordination, because the suggested test requests could trigger errors or unintended actions such as redeeming coupons

Try asking

  • “Walk me through an HPP test plan for this login form I'm authorised to assess”
  • “Which duplicate-parameter behaviours should I check for a Node.js Express app behind NGINX?”
  • “Suggest HPP test cases for a GraphQL API that uses aliasing and batch mutations”
  • “How could duplicate parameters help bypass a WAF on my staging server?”
Step-by-step guide: how to use HTTP Parameter Pollution ChecklistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-parameter-pollution.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-parameter-pollution.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-parameter-pollution.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it against applications you own or are explicitly authorised to test, and state the scope in your request.
  • Give the agent the request and response details you captured so it can track which checklist items are done.
  • Ask for the expected result on each test first, so you can judge whether a response indicates a real finding.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.