Input & Protocol Manipulation

Use When

• The main question is parser behavior, encoding, method override, header trust, smuggling, serialization, or injection capability.
• A request transformation may cross a parser, protocol, or trust boundary.

Handoff Criteria

• Hand off to pentest-authentication-authorization-review or pentest-advanced-access-control-auditor when an input anomaly becomes an authorization claim.
• Hand off to pentest-business-logic-abuse when the exploitability depends on workflow state.
• Hand off to pentest-evidence-structuring-report-synthesis when validation is complete.

Output Schema

• Test matrix: vector, payload class, expected secure behavior, observed behavior
• Validation state: hypothesis, confirmed, rejected
• Minimal reproducible request set

Instructions

1. Identify the parser or protocol boundary being tested before crafting payloads.
2. Start with low-noise capability checks, then increase payload complexity only when signal appears.
3. Compare positive and negative controls for every high-impact claim.
4. Separate parser anomalies from exploitable security outcomes.
5. Record exact request transformations required to reproduce behavior.
6. Escalate to exploit execution only after deterministic primitive confirmation.

Verification Gate

• Use structured payload families and deterministic sequencing.
• Preserve request/response evidence with context and timing.
• Keep tests bounded and reversible by default.
• Treat status-code differences as leads until a security effect is proven.
• Use positive and negative controls for every high-impact claim.
• Cross-check parser behavior with a different content type, method, client, or boundary when ambiguity remains.