Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-04
Testing for HTTP Parameter Pollution (HPP)
Passed 19 of 23 test cases with the skill, and 18 of 23 without it.
1 fixed18 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
According to standard CVSS v3 severity metrics, what severity level is assigned to HTTP Parameter Pollution flaws that enable authentication bypass or administrative privilege escalation?
| Checked | Without skill | With skill |
|---|---|---|
| The response classifies HPP leading to authentication bypass or privilege escalation as High severity. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-04
Testing for HTTP Parameter Pollution (HPP)
HTTP Parameter Pollution (HPP) occurs when an application doesn't properly handle multiple parameters with the same name. Different web servers and frameworks handle duplicate parameters differently, which can lead to bypassing input validation, WAF evasion, or logic manipulation.
#!/bin/bash
TARGET="https://target.com"
# Test duplicate parameters
echo "[*] Testing duplicate parameter handling..."
# Same parameter multiple times in query string
curl -s "$TARGET/search?q=test1&q=test2" | head -20
test cases passed, vs 18 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.