skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

http-smuggling-advanced

Exploit confirmed HTTP request smuggling vulnerabilities through chained attacks and HTTP/2 downgrade techniques.

1.7k|238|Updated Dec 7, 2019
Search Tags:#penetration testing#http request smuggling#web cache poisoning#h2c#cl-te#desync attack#http2 smuggling
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill http-smuggling-advanced
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: http-smuggling-advanced
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/exploit/advanced/http-smuggling-advanced
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill http-smuggling-advanced

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

After confirming a CL.TE, TE.CL, TE.TE, or H2.CL request smuggling vulnerability, testers need a structured methodology to turn the desync into demonstrable impact. This Skill provides the exploitation phase: chaining smuggled requests to steal credentials, bypass front-end ACLs, poison web caches, escalate reflected XSS to stored XSS, and abuse HTTP/2 downgrade paths.

Core Features & Use Cases

  • Chained Exploitation Playbooks: Ready-to-adapt request templates for credential theft via request prefix injection, front-end ACL bypass to reach /admin endpoints, web cache poisoning with malicious Host headers, and reflected-to-stored XSS escalation.
  • HTTP/2 Smuggling Coverage: Detailed references for H2.CL and H2.TE downgrade smuggling, CRLF injection in HTTP/2 pseudo-headers, H2.0 exclusive smuggling, and H2C cleartext upgrade smuggling with h2csmuggler.
  • Detection-to-Exploitation Workflow: Companion reference covers timing-based detection, differential response confirmation, OAST verification, Turbo Intruder and Burp HTTP Request Smuggler automation, and false-positive elimination.
  • Use Case: During an authorized engagement against a CDN-fronted application, you confirm CL.TE smuggling with timing probes, then use the Phase 1 templates to smuggle a request that captures the next user's session cookie, demonstrating account takeover impact for the report.

Quick Start

Ask the AI to walk you through exploiting a confirmed CL.TE smuggling vulnerability on your authorized test target, starting with the credential theft payload from Phase 1.

Frequently Asked Questions about http-smuggling-advanced

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a confirmed HTTP request smuggling vulnerability?▼

After confirming the smuggling type (CL.TE, TE.CL, or H2.CL), inject a smuggled request prefix that the backend treats as a separate request. Common chains include stealing the next user's cookies, bypassing front-end ACLs to reach /admin, or poisoning the web cache with a malicious Host header.

What tools detect HTTP request smuggling vulnerabilities?▼

Burp Suite's HTTP Request Smuggler extension automates detection of CL.TE, TE.CL, TE.TE, and H2 variants. smuggler.py provides command-line scanning, h2csmuggler tests H2C upgrade smuggling, and Turbo Intruder scripts enable custom differential-response probes.

How does HTTP/2 downgrade smuggling work?▼

HTTP/2 uses frame lengths instead of Content-Length, but front-end proxies downgrade requests to HTTP/1.1 for backends. If an attacker injects a content-length or transfer-encoding header that survives the downgrade, the backend misparses the body boundary, enabling H2.CL or H2.TE smuggling.

What is H2C smuggling and when does it work?▼

H2C smuggling abuses the HTTP/2 cleartext upgrade mechanism when a reverse proxy forwards the Upgrade: h2c header to a backend that supports it. The upgraded HTTP/2 connection bypasses the proxy's HTTP/1.1-layer checks, exposing internal paths like /admin or /metrics.

Why does timing-based smuggling detection produce false positives?▼

Server load, network jitter, WAF interception delays, and keep-alive timeouts can mimic the response delay expected from a desync probe. Run multiple baseline comparisons, alternate normal and probe requests, and confirm with differential-response or OAST methods before concluding.

What are the risks of testing request smuggling in production?▼

Smuggled request prefixes get prepended to the next user's request, potentially breaking their sessions or exposing their credentials. Testing should only occur with authorization, using unique identifiers, timing-based confirmation first, and minimal request volume.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

hunt-http-smuggling

Detects and validates HTTP request smuggling vulnerabilities via timing-based probes and desync payloads.

Community
Advanced
uphiagouphiago
1.1k

hunt-host-header

Identify and validate host header injection vulnerabilities in web applications.

Community
Advanced
defconxtdefconxt

Red Team — Web Application

Identify and exploit web application vulnerabilities with commands for SQL injection and API flaws.

Community
Advanced
six2dezsix2dez
1.4k

burp-scan

Coordinate Burp Suite scans via MCP for vulnerability identification.

Community
Advanced