hunt-http-smuggling

Featured

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.

AI & Automation 4,666 stars 702 forks Updated today MIT

Install

View on GitHub

Quality Score: 96/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

## 17. HTTP REQUEST SMUGGLING > Lowest dup rate. $5K–$30K. PortSwigger research by James Kettle. ### CL.TE (Content-Length front, Transfer-Encoding back) ```http POST / HTTP/1.1 Content-Length: 13 Transfer-Encoding: chunked 0 SMUGGLED ``` ### Detection ``` 1. Burp extension: HTTP Request Smuggler 2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe 3. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body ``` ### Impact Chain ``` Poison next request → access admin as victim Steal credentials → capture victim's session Cache poisoning → stored XSS at scale ``` --- ## Target-Suitability Matrix (2026 reality check) The classic CL.TE / TE.CL payloads are NOT universally exploitable in 2026. Modern proxies are RFC 9112 strict by default. Fingerprint the front-end BEFORE investing time. | Front-end | CL.TE | TE.CL | H2.CL | H2.TE | Notes | |---|---|---|---|---|---| | **Nginx ≥ 1.21** | NO | NO | partial (H2 ingress) | partial | RFC-strict; rejects CL+TE with HTTP 400. Verified locally on Nginx 1.27 — all 9 documented variants killed by front-end ([docs/verification/phase2h-smuggling-cachepoison.md](../../docs/verification/phase2h-smuggling-cachepoison.md)). | | **Caddy 2.x** | NO | NO | — | — | Hardened by default | | **Envoy ≥ 1.20** | NO | NO | partial | partial | Hardened in most paths | | **HAProxy ≤ 2.4** | ✓ | ✓ | — | — | **Vulnerable**, see CVE-2021-40346 | | **AWS ALB + specific upstream** | partial | partial | ✓ | ✓ | Sev...

Details

Author
elementalsouls
Repository
elementalsouls/Claude-BugHunter
Created
4 months ago
Last Updated
today
Language
Python
License
MIT

Integrates with

Anthropic · AI

Bundled in these plugins

Claude-BugHunter

Similar Skills

Semantically similar based on skill content — not just same category

Data & Documents Listed

request-smuggling

HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.

12 Updated today
SecurityTalent
AI & Automation Listed

testing-request-smuggling

Test whether a chain of HTTP servers disagrees about where one request ends and the next begins, letting an attacker smuggle a request past the front end into the back end. Covers front-end and back-end desync from conflicting length signals, connection-reuse poisoning, single-packet and timing detection, and adjacent boundary confusion where a proxy and origin parse framing differently. Use when reviewing a reverse proxy, load balancer, CDN, or any multi-hop HTTP path where two parsers sit in series. The bug is a disagreement between parsers, not one flaw.

5 Updated 2 weeks ago
UnboundCompute
DevOps & Infrastructure Listed

http2-specific-attacks

HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.

12 Updated today
SecurityTalent