mcpField
P
pentest-input-protocol-manipulation

pentest-input-protocol-manipulation

github.com/crtvrffnrtSecurity460 installsUpdated 5w ago
Repository

About pentest-input-protocol-manipulation

pentest-input-protocol-manipulation is a security testing skill for examining parser behavior, encoding, headers, serialization, and injection across protocol boundaries. It helps security testers distinguish anomalies from exploitable outcomes using controlled tests and reproducible evidence.

Key features

  1. 01Identify parser and protocol boundaries
  2. 02Test structured payload families with controls
  3. 03Record request transformations and evidence
  4. 04Separate anomalies from security impact
  5. 05Produce a test matrix and reproducible requests

Use cases

  1. 01Investigate parser behavior across content types
  2. 02Assess header trust or method override handling
  3. 03Validate suspected injection or request smuggling

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/crtvrffnrt/skills --skill pentest-input-protocol-manipulation

After installing, type/pentest-input-protocol-manipulationin Claude Code to confirm it loaded.

Details

From the project README

Input & Protocol Manipulation

Use When

  • The main question is parser behavior, encoding, method override, header trust, smuggling, serialization, or injection capability.
  • A request transformation may cross a parser, protocol, or trust boundary.

Handoff Criteria

  • Hand off to pentest-authentication-authorization-review or pentest-advanced-access-control-auditor when an input anomaly becomes an authorization claim.
  • Hand off to pentest-business-logic-abuse when the exploitability depends on workflow state.
  • Hand off to pentest-evidence-structuring-report-synthesis when validation is complete.

Output Schema

  • Test matrix: vector, payload class, expected secure behavior, observed behavior
  • Validation state: hypothesis, confirmed, rejected
  • Minimal reproducible request set

Instructions

  1. Identify the parser or protocol boundary being tested before crafting payloads.
  2. Start with low-noise capability checks, then increase payload complexity only when signal appears.
  3. Compare positive and negative controls for every high-impact claim.
  4. Separate parser anomalies from exploitable security outcomes.
  5. Record exact request transformations required to reproduce behavior.
  6. Escalate to exploit execution only after deterministic primitive confirmation.

Verification Gate

  • Use structured payload families and deterministic sequencing.
  • Preserve request/response evidence with context and timing.
  • Keep tests bounded and reversible by default.
  • Treat status-code differences as leads until a security effect is proven.
  • Use positive and negative controls for every high-impact claim.
  • Cross-check parser behavior with a different content type, method, client, or boundary when ambiguity remains.

Comments

Markdown supported