skills.rest
bingook
bingookCOMMUNITY
Explore all skills by this author →
GitHub

request-smuggling

Detect HTTP request smuggling and desynchronization vulnerabilities in web applications.

Updated Aug 23, 2026
Search Tags:#vulnerability assessment#web application security#http request smuggling#desynchronization testing#http/1.1 framing
One-click install
npx skills add https://github.com/bingook/bingo --skill request-smuggling-bingook
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: request-smuggling
Source: https://github.com/bingook/bingo/tree/main/bingo/skills/hack-skills/request-smuggling
Command: npx skills add https://github.com/bingook/bingo --skill request-smuggling-bingook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill is designed to identify HTTP request smuggling and desynchronization vulnerabilities, allowing for testing and exploitation of such issues in web applications.

Core Features & Use Cases

  • HTTP Request Smuggling: Detects vulnerabilities where front proxies, CDNs, or load balancers disagree on message framing, leading to potential security breaches.
  • Desynchronization Testing: Tests for discrepancies in how different components of a web application handle HTTP requests, potentially leading to bypassing security measures.
  • Use Case: For example, it can be used to test if a CDN is vulnerable to request smuggling, which could allow an attacker to bypass security checks.

Quick Start

Load the request-smuggling skill and use it to test the target at 'https://example.com'.

Frequently Asked Questions about request-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is HTTP request smuggling and how does desynchronization testing detect it?▼

HTTP request smuggling occurs when front-end proxies and back-end servers disagree on HTTP/1.1 message framing boundaries. Desynchronization testing detects these discrepancies by sending specially crafted requests to identify when components handle message boundaries inconsistently, bypassing security controls.

How do I test my web application for HTTP request smuggling vulnerabilities?▼

To test web applications for HTTP request smuggling, load the testing scripts and target the specific URL. The process involves sending malformed HTTP/1.1 requests to the web application to detect message framing disagreements between reverse-proxy components like CDNs and load balancers.

Can I use this to test a CDN or reverse-proxy topology for request smuggling?▼

Yes, this specifically tests reverse-proxy topologies, CDNs, and load balancers for request smuggling. It identifies security vulnerabilities where these front-end proxy components disagree with back-end servers on HTTP/1.1 message framing, potentially allowing attackers to bypass security checks.

What do I need to know about HTTP/1.1 framing to perform desynchronization testing?▼

Effective desynchronization testing requires knowledge of HTTP/1.1 framing mechanisms and reverse-proxy topologies. Understanding how different web application components parse and delimit HTTP messages is essential to identify the framing discrepancies that lead to HTTP request smuggling vulnerabilities.

Why does HTTP request smuggling bypass security measures in web applications?▼

HTTP request smuggling bypasses security measures because desynchronization between front-end proxies and back-end servers allows malicious payloads to slip past front-end security checks. The discrepancy in HTTP/1.1 message framing causes the back-end to interpret injected requests as legitimate traffic.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

request-smuggling

Detects and analyzes HTTP desynchronization vulnerabilities across front-end to origin server topologies.

Community
Advanced
AcczdyAcczdy
2

exploiting-http-request-smuggling

Probe HTTP parsing discrepancies to detect CL.TE, TE.CL, and TE.TE smuggling variants.

Community
Advanced
dapperdiversdapperdivers
1

vuln-scan

Scan web applications for vulnerabilities using nuclei and nikto.

Community
Advanced
Prohao42Prohao42
120

request-smuggling

Detect CL.TE, TE.CL, and HTTP/2 downgrade desynchronization between proxies and origins.

Community
Advanced