hunt-http-smuggling

Use single, stateless requests containing only your own markers to check for parsing divergence between front-end and back-end servers. Always establish a clean baseline first, send a clean request after each experiment, and stop immediately on any timeout or connection anomaly.

CL/TE desynchronization occurs when a front-end proxy and back-end server disagree on whether Content-Length or Transfer-Encoding defines the request boundary. This skill detects that disagreement through controlled differential checks on authorized targets only.

Yes, but only with strict preconditions: a written testing window, an isolated test path or tenant, low concurrency limits, and identifiable self-owned markers. Without these conditions, only passive version and configuration audits should be performed.

Timeouts, 502s, CDN errors, and speed changes can result from network jitter or WAF behavior, not parsing divergence. Valid evidence requires reproducible, isolated boundary disagreement with a clean control request ruling out environmental noise.

The workflow uses Burp Suite's controlled Repeater and the hunter_auto_smuggling safe detection mode to execute differential checks. These tools send short, non-destructive probes rather than exploit payloads.

Stop when no isolated test path exists, when other users' responses or cross-session data appear, when performance degrades, or when a second polluting request would be needed. Record findings as INCONCLUSIVE and preserve sanitized wire evidence.