web-vuln-http-smuggling

What this skill does

Detects HTTP request smuggling vulnerabilities by exploiting disagreements between front-end (reverse proxy/CDN) and back-end (application server) parsers over how to determine request boundaries. Tests CL.TE (Content-Length front, Transfer-Encoding back), TE.CL (Transfer-Encoding front, Content-Length back), TE.TE (both use Transfer-Encoding but with obfuscation), and H2.CL (HTTP/2 downgrade to HTTP/1.1) variants using timing-based probes and differential response analysis.

When to use

• When the target sits behind a reverse proxy, CDN, or load balancer (Nginx, HAProxy, AWS ALB, Cloudflare, Fastly)
• When testing for WAF bypass, request hijacking, cache poisoning, or credential theft
• During high-value bug bounty targets with multi-tier HTTP infrastructure
• When initial recon reveals Via, X-Forwarded-For, or X-Cache response headers indicating a proxy layer

Prerequisites

• curl compiled with HTTP/1.1 support (standard on Linux/macOS)
• netcat (nc) for raw TCP requests
• Burp Suite with HTTP Request Smuggler extension (optional, for automated scanning)
• A test account on the target for differential response verification

Inputs