HTTP Request Smuggling
Exploit disagreements between a front-end proxy and back-end server on where one request ends, to poison the connection of the next user.
Every step requires authorization. Review side effects before running commands against a live system.
Identify a desync
Send crafted Content-Length / Transfer-Encoding combinations and time the responses. A delay on a TE.CL/CL.TE probe indicates the back-end is waiting for bytes that never come.
python3 smuggler.py -u https://target.com/Confirm CL.TE vs TE.CL
Use Burp Repeater with HTTP/1.1 and disabled auto-Content-Length. Confirm by smuggling a partial request that prepends to the victim's next request.
Try H2.CL / H2.TE downgrade
If the edge speaks HTTP/2 but downgrades to HTTP/1.1 upstream, smuggle via ambiguous h2 headers. Also test h2c upgrade for access-control bypass.
python3 h2csmuggler.py -x https://edge.target.com http://target/adminWeaponize
Escalate to capturing other users' requests (session theft), bypassing front-end auth to reach internal paths, or reflected-XSS delivery via the poisoned socket.
Common guidance
- Always use Burp's 'HTTP Request Smuggler' extension for reliable, non-destructive probes.
- Smuggling can affect other real users - keep payloads benign and coordinate with the program.
- Retry: results are timing/queue dependent, not always first-shot.
Mapped workflow tools
References
Version history: normalized permanent page created 2026-08-20.