skills.rest
hhjkjkjk
hhjkjkjkCOMMUNITY
Explore all skills by this author →
GitHub

hunt-http-smuggling

Detect and validate HTTP request smuggling vulnerabilities across proxy and origin server stacks.

Updated May 29, 2026
Search Tags:#penetration testing#bug bounty#burp suite#http request smuggling#cache poisoning#cl.te#h2.cl
One-click install
npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-http-smuggling-hhjkjkjk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-http-smuggling
Source: https://github.com/hhjkjkjk/Claude-skills/tree/main/skills/hunt-http-smuggling
Command: npx skills add https://github.com/hhjkjkjk/Claude-skills --skill hunt-http-smuggling-hhjkjkjk

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? HTTP request smuggling occurs when a front-end proxy and back-end server disagree on request boundaries due to Content-Length vs Transfer-Encoding parsing inconsistencies, and it is difficult to detect and confirm without structured guidance on which payload variants work against which server stacks. ## Core Features & Use Cases - Variant Coverage: Documents CL.TE, TE.CL, H2.CL, and H2.TE smuggling techniques with detection via Burp HTTP Request Smuggler, smuggler.py, and h2csmuggler. - Target-Suitability Matrix: Maps which front-end servers (Nginx, Caddy, Envoy, HAProxy, AWS ALB, Cloudflare, F5, Citrix, Squid) are vulnerable to which smuggling variants, preventing wasted effort on hardened targets. - Impact Validation Chains: Explains how to confirm exploitability through time-delay probes, cache poisoning, credential capture, and front-end auth bypass, plus a pre-severity gate requiring cross-client impact. - Use Case: When testing a bug bounty target behind a CDN and origin stack, fingerprint the front-end server, select the viable smuggling variant from the matrix, and confirm with a time-delay probe before building a cache poisoning or session theft chain. ## Quick Start Fingerprint the target's front-end server with a curl header check, then use the suitability matrix to pick a viable smuggling variant and confirm it with a time-delay probe.

Frequently Asked Questions about hunt-http-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect HTTP request smuggling vulnerabilities?▼

Use the Burp HTTP Request Smuggler extension by right-clicking a request and running Smuggle probe, or use smuggler.py and h2csmuggler for command-line testing. Confirm manually with a time-delay probe: a CL.TE probe causing roughly a 10-second delay indicates the back-end is waiting for more body data.

What is the difference between CL.TE and TE.CL smuggling?▼

CL.TE means the front-end uses Content-Length while the back-end uses Transfer-Encoding, so you send Transfer-Encoding: chunked with a body that fits the Content-Length count. TE.CL is the opposite arrangement, with the front-end honoring Transfer-Encoding and the back-end honoring Content-Length.

Does HTTP request smuggling work against Nginx or Caddy?▼

No. Nginx 1.21+ and Caddy 2.x are RFC 9112 strict and reject requests containing both Content-Length and Transfer-Encoding with HTTP 400. Against these front-ends, pivot to H2.CL or H2.TE downgrade attacks if the server speaks HTTP/2, or look for legacy proxies upstream.

Which tools should I use for HTTP/2 smuggling attacks?▼

Use tools that send raw HTTP/2 frames: Burp Pro's HTTP Request Smuggler extension, h2csmuggler, or smuggler.py. Avoid HTTP/1.1-only clients like curl or raw sockets against H2-fronted targets, since they send the wrong protocol entirely.

Why does my smuggling finding get rejected as not exploitable?▼

A timing delta observed only in your own browser shows parser disagreement, not exploitable smuggling. The smuggled request's effect must land on a request issued by a different client or session, such as poisoning a cached response served to other victims or capturing another user's cookies.

When is HTTP request smuggling not worth testing?▼

Skip classic CL.TE and TE.CL payloads when the front-end is a modern hardened proxy like Nginx 1.21+, Caddy, or recent Envoy, since they reject ambiguous requests by default. Invest time only when fingerprinting reveals HAProxy 2.4 or older, AWS ALB chains, Cloudflare-to-origin H2 downgrades, or legacy F5, Citrix, or Squid deployments.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

hunt-http-smuggling

Detects and validates HTTP request smuggling vulnerabilities via timing-based probes and desync payloads.

Community
Advanced
SkobynSkobyn

hunt-http-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using time-delay techniques.

Community
Advanced
uphiagouphiago
1.1k

hunt-cache-poison

Identify and validate cache poisoning and Web Cache Deception vulnerabilities in CDN-fronted web applications.

Community
Advanced
chatbotkitchatbotkit
13

security-arsenal

Catalog offensive security payloads for XSS, SSRF, SQLi, and related vulnerabilities.

Official
Advanced