Skip to content

Advanced Testing (/test-advanced)

Tests for advanced attack classes not covered by the core injection/auth/access skills: HTTP Parameter Pollution, CRLF injection, open redirect, type juggling, unicode normalization bypass, HTTP/2 desync detection, second-order injection, MFA bypass (20+ techniques), Host header attacks, and HTTP method override.

/test-advanced <target_url> [engagement_dir]

Scope Routing

Scope Sections Focus
hpp-crlf A (HPP) + B (CRLF) + I (Param truncation) + K (Filename injection) Parameter and header injection variants -- duplicate parameter handling, CRLF header injection, log injection, parameter truncation, filename injection
bypass C (Open redirect) + D (Type juggling) + E (Unicode) + J (Parser diff) + L (Content-Type switching) Validation and filter bypass techniques -- redirect bypass (15+ patterns), PHP/Node.js type juggling, unicode normalization, parser differentials
mfa H (H1-H20) MFA bypass -- 20+ techniques including MFA downgrade, TOTP bruteforce, OTP reuse, flow bypass, backup code abuse, device trust manipulation
host-method F (HTTP/2 desync) + G (Second-order) + M (Hidden params) + N (Host header) + O (Method override) Infrastructure-adjacent attacks -- HTTP/2 desync detection, second-order injection, hidden parameter discovery, Host header poisoning, HTTP method override

Coverage

  • HTTP Parameter Pollution -- Duplicate GET parameters, GET+POST collision, HPP for WAF bypass. Framework-specific behavior (PHP last wins, ASP.NET concatenates, JSP/Flask first wins, Express returns array).
  • CRLF Injection -- Header injection via %0d%0a sequences, response splitting, log injection via CRLF in username/User-Agent/Referer fields. Fuzzing with PayloadsAllTheThings CRLF wordlists.
  • Open Redirect -- 30+ redirect parameter names tested, 15+ bypass patterns (protocol-relative, backslash, URL encoding, at-sign, null bytes, unicode, case variation).
  • Type Juggling -- PHP loose comparison bypass ("0" == false, "0e123" == "0e456"), Node.js type coercion. Only tested when backend is PHP or Node.js.
  • Unicode Normalization -- NFKC/NFKD normalization bypass for auth, email, and domain validation. Homograph attacks.
  • HTTP/2 Desync Detection -- Detection-only (no exploitation). Requires user confirmation before running.
  • Second-Order Injection -- Payloads stored in one location, triggered in another (e.g., username stored, rendered in admin panel).
  • MFA Bypass -- 20+ techniques: MFA downgrade (remove MFA parameter), TOTP brute-force (6-digit = 1M possibilities), OTP reuse, flow bypass (skip MFA step), backup code brute-force, device trust cookie manipulation, MFA enrollment bypass, parallel session bypass, response manipulation.
  • Host Header Attacks -- Password reset poisoning, cache poisoning via Host header, X-Forwarded-Host injection.
  • HTTP Method Override -- X-HTTP-Method-Override, X-Method-Override, _method parameter for bypassing method-based access controls.
  • Parameter Truncation -- Long parameter values that get truncated server-side, potentially bypassing validation.
  • Parser Differentials -- Exploiting differences in how front-end and back-end parse the same request.
  • Hidden Parameter Discovery -- Brute-forcing hidden parameters that modify application behavior.
  • Content-Type Switching -- Changing Content-Type to bypass validation (e.g., multipart/form-data to bypass JSON validation).
  • Filename Injection -- Injecting payloads in Content-Disposition filename parameter.

Key Sections

Section ID Description
HTTP Parameter Pollution A Duplicate params (A1), GET+POST collision (A2), HPP WAF bypass (A3).
CRLF Injection B Header injection payloads (B1), CRLF fuzzing (B2), log injection (B.LOG).
Open Redirect C Redirect parameter discovery (C1), 15+ bypass patterns (C2).
Type Juggling D PHP loose comparison (D1), Node.js coercion (D2). Conditional on tech stack.
Unicode Normalization E NFKC/NFKD bypass, homograph attacks.
HTTP/2 Desync F Detection-only. Requires user confirmation.
Second-Order Injection G Store payload in one context, trigger in another. Requires authenticated session.
MFA Bypass H1-H20 20+ techniques: downgrade, TOTP brute, OTP reuse, flow skip, backup codes, device trust, enrollment bypass, parallel sessions, response manipulation.
Parameter Truncation I Long value truncation bypass.
Parser Differentials J Front-end/back-end parsing mismatches.
Filename Injection K Content-Disposition filename payloads.
Content-Type Switching L Validation bypass via Content-Type change.
Hidden Parameters M Parameter brute-forcing for hidden behaviors.
Host Header N Password reset poisoning, cache poisoning.
Method Override O X-HTTP-Method-Override, _method bypass.

Context-Driven Testing

This skill reads context.json to conditionally enable or skip certain tests:

Condition Tests Affected
tech_stack.backend is PHP or Node.js Type juggling (D) enabled
User confirmation obtained HTTP/2 desync (F) enabled
auth.mfa is true MFA bypass (H) enabled
Authenticated session available Second-order injection (G) enabled

Model and Thinking Budget

Component Model Rationale
HPP/CRLF Sonnet Systematic payload testing
Bypass techniques Sonnet Methodical filter bypass enumeration
MFA bypass Opus (medium) Creative reasoning for multi-step MFA flow attacks
Host/Method override Sonnet Procedural testing

Kill Switch

Limit Value
Timeout 45 minutes
Max requests 500 (warning at 400)
Auth rate 1 req/sec for MFA/auth-related tests

AI Decision Points

No explicit [AI-DECISION] markers in this skill. However, context-driven conditional testing requires AI reasoning to:

  • Determine which tests apply based on the fingerprinted tech stack.
  • Analyze response differences for HPP, CRLF, and type juggling confirmation.
  • Identify the most promising MFA bypass technique based on the MFA implementation observed.

Knowledge Packs and Cheatsheets

Resource Path
MFA bypass knowledge (20 techniques) helpers/knowledge-mfa-bypass.md
Second-order injection and unicode helpers/knowledge-second-order.md
CRLF knowledge helpers/knowledge-crlf.md
Open redirect knowledge helpers/knowledge-open-redirect.md
Research terms helpers/research-terms.md

External payload files: PayloadsAllTheThings CRLF injection intruder lists and open redirect intruder lists.

Safety

  • All tests are non-destructive.
  • HTTP/2 desync is detection-only -- no exploitation payloads sent.
  • User confirmation required before desync tests.
  • Never test MFA with real user accounts -- use provided test credentials only.