hunt-http-smuggling

To identify HTTP request smuggling vectors, test for CL.TE, TE.CL, H2.CL, and H2.TE discrepancies between front-end proxies and back-end servers using time-delay experiments and tool integration to verify cache poisoning or auth bypass impacts.

CL.TE and TE.CL are HTTP smuggling techniques where the front-end and back-end servers disagree on Content-Length versus Transfer-Encoding headers, allowing request boundary manipulation. H2.CL and H2.TE extend this to HTTP/2 downgrade scenarios.

Yes, you can use the Burp HTTP Request Smuggler extension and h2csmuggler to detect H2.CL and H2.TE smuggling vulnerabilities. These tools support deterministic verification through time-delay experiments in authorized testing environments.

Verify HTTP request smuggling vulnerabilities deterministically by applying time-delay experiments to confirm request desynchronization, and testing cache-poisoning or credential-reuse scenarios to map potential impacts on WAFs and load balancers.

HTTP request smuggling testing maps potential impacts on front-end proxies, WAFs, and load balancers by exploiting desynchronization. It provides evidence chains for auth bypass and cache poisoning in controlled, authorized red-team environments.

You should avoid running HTTP request smuggling tests outside of authorized, controlled environments. Testing for CL.TE or TE.CL vectors on production CDN-origin pipelines without explicit permission risks causing cache poisoning and request desynchronization.