# Pentest Input Protocol Manipulation

> Input validation and protocol manipulation assessment for injection, parser differential testing, request smuggling, method tampering, header confusion, serialization abuse, and payload mutation. Hands off to authz, business-logic, exploit, or reporting workflows when those become the owner phase.

- Skill: `crtvrffnrt/pentest-input-protocol-manipulation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add crtvrffnrt/pentest-input-protocol-manipulation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/crtvrffnrt/pentest-input-protocol-manipulation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: crtvrffnrt (https://skillmd.com/u/crtvrffnrt)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/crtvrffnrt/pentest-input-protocol-manipulation

---


# Input & Protocol Manipulation

## Use When
- The main question is parser behavior, encoding, method override, header trust, smuggling, serialization, or injection capability.
- A request transformation may cross a parser, protocol, or trust boundary.

## Handoff Criteria
- Hand off to `pentest-authentication-authorization-review` or `pentest-advanced-access-control-auditor` when an input anomaly becomes an authorization claim.
- Hand off to `pentest-business-logic-abuse` when the exploitability depends on workflow state.
- Hand off to `pentest-evidence-structuring-report-synthesis` when validation is complete.

## Output Schema
- Test matrix: `vector`, `payload class`, `expected secure behavior`, `observed behavior`
- Validation state: `hypothesis`, `confirmed`, `rejected`
- Minimal reproducible request set

## Instructions
1. Identify the parser or protocol boundary being tested before crafting payloads.
2. Start with low-noise capability checks, then increase payload complexity only when signal appears.
3. Compare positive and negative controls for every high-impact claim.
4. Separate parser anomalies from exploitable security outcomes.
5. Record exact request transformations required to reproduce behavior.
6. Escalate to exploit execution only after deterministic primitive confirmation.

## Verification Gate
- Use structured payload families and deterministic sequencing.
- Preserve request/response evidence with context and timing.
- Keep tests bounded and reversible by default.
- Treat status-code differences as leads until a security effect is proven.
- Use positive and negative controls for every high-impact claim.
- Cross-check parser behavior with a different content type, method, client, or boundary when ambiguity remains.