skills.rest
chatbotkit
chatbotkitOFFICIAL
Explore all skills by this author →
WebsiteGitHub

hunt-http-smuggling

Detect HTTP request smuggling variants using Burp extension and time-delay techniques.

13|2|Updated Jun 1, 2026
Search Tags:#cdn#web-security#penetration-testing#security-testing#http-smuggling#proxy-bypass
One-click install
npx skills add https://github.com/chatbotkit/rook --skill hunt-http-smuggling-chatbotkit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-http-smuggling
Source: https://github.com/chatbotkit/rook/tree/main/skills/hunt-http-smuggling
Command: npx skills add https://github.com/chatbotkit/rook --skill hunt-http-smuggling-chatbotkit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies and tests HTTP request smuggling vectors across front-end proxies and back-end servers, exposing misconfigurations that enable bypass paths and data exposure.

Core Features & Use Cases

  • Detect CL.TE, TE.CL, H2.CL, and H2.TE smuggling variants across CDN and origin server deployments.
  • Provide guided verification using Burp's HTTP Request Smuggler extension, smuggler.py, and h2csmuggler, including time-delay confirmation techniques.
  • Real-world usage includes validating cache-poisoning, credential theft, and authentication bypass chains in modern web architectures.

Quick Start

Launch a controlled smuggling probe against a test target to validate suspected CL.TE/TE.CL/H2 variants.

Frequently Asked Questions about hunt-http-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for HTTP request smuggling vulnerabilities in front-end proxies?▼

To test for HTTP request smuggling, probe front-end proxies and back-end servers using time-delay techniques to validate CL.TE, TE.CL, H2.CL, and H2.TE variants. This reveals misconfigurations that enable bypass paths and data exposure.

What is an HTTP request smuggling attack and how does it bypass CDN security?▼

HTTP request smuggling exploits discrepancies in how front-end proxies and back-end servers parse HTTP requests. It bypasses CDN security by injecting hidden requests to exploit caching, credential theft, and authentication bypass chains.

How do I verify CL.TE and TE.CL smuggling variants?▼

Verify CL.TE and TE.CL smuggling variants using time-delay confirmation techniques. Guided verification is supported through integration with Burp's HTTP Request Smuggler extension, smuggler.py, and h2csmuggler to validate suspected vectors.

Does this support testing H2.CL and H2.TE smuggling in enterprise stacks?▼

Yes, it supports testing H2.CL and H2.TE smuggling variants in enterprise stacks. It identifies misconfigurations across CDN and origin server deployments to validate cache-poisoning and authentication bypass chains.

What tools work with HTTP request smuggling detection?▼

HTTP request smuggling detection works with Burp's HTTP Request Smuggler extension, smuggler.py, and h2csmuggler. These tools apply time-delay techniques to validate vulnerabilities across proxy and origin server deployments.

Related Skills

Explore More Software Engineering Skills→
pdparchitectpdparchitect
13

hunt-http-smuggling

Detect and validate HTTP request smuggling vectors between proxies and servers.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-http-smuggling

Detect HTTP request smuggling vulnerabilities by analyzing header parsing inconsistencies.

Community
Advanced
elementalsoulselementalsouls
3.3k

hunt-http-smuggling

Detect and document HTTP request smuggling techniques across CDN-origin pipelines.

Community
Advanced
TheBushidoCollectiveTheBushidoCollective
187

PHP Security Patterns

Detect and prevent security vulnerabilities in PHP web applications.

Official
Advanced