skills.rest
balsm-health
balsm-healthOFFICIAL
Explore all skills by this author →
Website𝕏@balsm_healthGitHub

exploiting-http-request-smuggling

Detect and exploit HTTP request smuggling via front-end and back-end parsing discrepancies.

2|Updated Jun 5, 2026
Search Tags:#cybersecurity#web-security#vulnerability-detection#penetration-testing#http-request-smuggling
One-click install
npx skills add https://github.com/balsm-health/Balsm-AI --skill exploiting-http-request-smuggling-balsm-health
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-http-request-smuggling
Source: https://github.com/balsm-health/Balsm-AI/tree/main/plugin/skills/exploiting-http-request-smuggling
Command: npx skills add https://github.com/balsm-health/Balsm-AI --skill exploiting-http-request-smuggling-balsm-health

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, socket, ssl, time, urllib.parse, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and exploits HTTP request smuggling vulnerabilities in web applications, which can lead to bypassing security controls and accessing sensitive data.

Core Features & Use Cases

  • Detect HTTP Request Smuggling: Identifies vulnerabilities where front-end and back-end servers parse HTTP requests differently.
  • Exploit Smuggling Vulnerabilities: Uses discovered vulnerabilities to bypass security controls and access sensitive data.
  • Use Case: For penetration testers looking to uncover security weaknesses in web applications by exploiting HTTP request smuggling vulnerabilities.

Quick Start

Run the skill by executing the command: python scripts/agent.py --url https://target.example.com/

Frequently Asked Questions about exploiting-http-request-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect HTTP request smuggling vulnerabilities in web applications?▼

To detect HTTP request smuggling vulnerabilities, this Skill analyzes the parsing discrepancy between front-end and back-end servers by executing targeted scripts against a target URL to identify inconsistent request processing.

What is HTTP request smuggling and how does parsing discrepancy bypass security controls?▼

HTTP request smuggling occurs when front-end and back-end servers parse HTTP requests differently, allowing an attacker to smuggle hidden requests that bypass security controls and access sensitive data.

How to exploit HTTP request smuggling vulnerabilities to access sensitive data?▼

You can exploit HTTP request smuggling by running the provided Python scripts against the target application, using discovered parsing discrepancies to craft smuggled requests that bypass access controls.

Can I use Python and socket connections to test for HTTP request smuggling?▼

Yes, you can test for HTTP request smuggling using Python with socket and ssl libraries, which handle raw HTTP request construction and secure transmission during penetration testing.

What web application architecture knowledge is required to perform penetration testing for HTTP request smuggling?▼

Performing HTTP request smuggling penetration testing requires knowledge of web application architecture, specifically how front-end and back-end servers parse HTTP requests, to accurately interpret automated testing results.

Why does HTTP request smuggling detection fail when target architecture is unknown?▼

HTTP request smuggling detection relies on identifying parsing discrepancies between server layers; without understanding the specific front-end and back-end architecture, accurately interpreting the vulnerability testing results is unreliable.

Related Skills

Explore More Software Engineering Skills→
cmndcntrlcybercmndcntrlcyber
3

hunt-http-smuggling

Detect HTTP request smuggling vulnerabilities by analyzing header parsing inconsistencies.

Community
Advanced
langbyyilangbyyi
96

insecure-source-code-management

Detect exposed .git, .svn, .hg metadata and backup files on web applications.

Community
Intermediate
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
AcczdyAcczdy
2

exploiting-http-request-smuggling

Probe HTTP parsing discrepancies to detect CL.TE, TE.CL, and TE.TE smuggling variants.

Community
Advanced