HTTP request smuggling
Front-end and origin disagree on Content-Length vs Transfer-Encoding. Prove with a harmless probe on a connection you own. Do not poison other users.
Playbooks
- HTTP Request Smuggling - Exploit disagreements between a front-end proxy and back-end server on where one request ends, to poison the connection of the next user.
- CRLF / header injection - A parameter that lands in a response header or a backend request header is a split gadget. Prove a new header you control, then ask what it becomes.
Gadgets
- HTTP request smuggling desync - Front-end and origin disagree on Content-Length vs Transfer-Encoding. That desync is a request queue gadget, not a party trick.
Payloads
- HTTP request smuggling - Desync probes for CL.TE / TE.CL / HTTP/2 downgrade. Lab or authorized target only. Do not desync a production CDN for fun.
Bypasses
- HTTP desync probes - Front-end vs origin disagreement on CL vs TE. Detect with a harmless timeout or echo. Do not poison other users.
Tools
- smuggler - Detects HTTP request smuggling (CL.TE / TE.CL desync) against a target with minimal, safe probes. First stop before manual desync exploitation.
- h2csmuggler - Tests for HTTP/2 cleartext (h2c) smuggling to bypass reverse-proxy access controls and reach restricted internal endpoints.
Questions
Can I capture victim cookies?
Not on a live bounty with real users. Lab, or two sessions you own. Detection plus a documented hop mismatch is the first report.
HTTP/2?
h2 to the edge, HTTP/1 to origin is where CL/TE reappears. h2c smuggling is a sibling gadget.
This page is the public form of hunt_brief("smuggling") on the MCP connector. Authorized testing only.