HTTP desync probes
Front-end vs origin disagreement on CL vs TE. Detect with a harmless timeout or echo. Do not poison other users.
Tags: smuggling, desync, http
Techniques
CL.TE probe
Content-Length and Transfer-Encoding both set. Look for a timeout or a 400 that depends on hop.
Transfer-Encoding: chunked plus a Content-Length the front-end trusts
TE.CL probe
The other direction. Same rule: observe only your connection.
smuggler.py -u https://target.example
HTTP/2 downgrade
h2 to the edge, HTTP/1 to origin. Inside the translated request is where CL/TE reappears.
:method POST with a smuggled inner request on a lab host
Stop condition
A detection probe you can reproduce on a session you own is enough. Do not capture victim cookies.
document the hop behaviour and stop