What problem does it solve? When a request is interpreted differently by a front proxy, gateway, and backend server, attackers can reach hidden routes or bypass controls, and testers struggle to pinpoint which hop diverges. This Skill provides a structured workflow to map parsing boundaries, prove differential interpretation, and reduce the finding to a minimal replayable smuggling chain in CTF sandbox environments. ## Core Features & Use Cases - Parse Boundary Mapping: Record path decoding, slash and dot-segment handling, header canonicalization, Host derivation, and CL/TE framing behavior at every hop from edge proxy to backend. - Differential Proof: Build paired requests differing in exactly one canonicalization dimension, then capture proxy logs, backend logs, and route matches to show where interpretation diverges. - Decisive Chain Reduction: Compress findings into a minimal crafted request -> parser differential -> unintended route or hidden endpoint -> observable effect, with explicit root-cause attribution. - Use Case: During a CTF web challenge, you suspect a hidden admin endpoint is reachable only when the frontend normalizes a path differently than the backend. Use this Skill to craft baseline and differential requests, identify the exact normalization delta, and reproduce the smuggling route. ## Quick Start Ask the agent to trace how a crafted request is parsed differently across the proxy and backend hops and reproduce the minimal differential request that reaches the hidden route.
