skills.rest
Skobyn
SkobynCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-http-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using time-delay techniques.

Updated Jun 24, 2026
Search Tags:#vulnerability detection#web application security#security assessment#http request smuggling#network exploitation
One-click install
npx skills add https://github.com/Skobyn/talon --skill hunt-http-smuggling-skobyn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-http-smuggling
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-http-smuggling
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-http-smuggling-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Burp Suite, smuggler.py, h2csmuggler, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and exploit HTTP request smuggling vulnerabilities in web applications, which occur when front-end and back-end servers disagree on where one request ends and the next begins.

Core Features & Use Cases

  • Detection: Identifies HTTP request smuggling vectors like CL.TE, TE.CL, H2.CL, and H2.TE.
  • Impact Analysis: Provides potential impact scenarios such as poison cache, steal credentials, or bypass authentication.
  • Target Suitability: Assesses target suitability based on front-end and back-end server configurations.
  • Tools and Techniques: Offers guidance on using tools like Burp HTTP Request Smuggler, smuggler.py, and h2csmuggler for detection.

Quick Start

Use the hunt-http-smuggling skill to scan for HTTP request smuggling vulnerabilities in the target application.

Frequently Asked Questions about hunt-http-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect HTTP request smuggling vulnerabilities in web applications?▼

HTTP request smuggling vulnerabilities are detected by analyzing server header responses and applying time-delay techniques to find front-end and back-end server disagreements. This Skill identifies CL.TE, TE.CL, H2.CL, and H2.TE vectors.

What is HTTP request smuggling and how does it impact web security?▼

HTTP request smuggling occurs when front-end and back-end servers disagree on request boundaries. This Skill validates impact through cache poisoning, credential theft, and authentication bypass scenarios to assess web application security risks.

How do I use Burp Suite and smuggler.py for HTTP request smuggling detection?▼

Burp HTTP Request Smuggler, smuggler.py, and h2csmuggler are used for detecting smuggling vectors. This Skill provides guidance on leveraging these tools to scan target applications and analyze server configurations for vulnerabilities.

Can I assess target suitability for HTTP request smuggling before exploitation?▼

Target suitability for HTTP request smuggling is assessed by evaluating front-end and back-end server configurations. This Skill helps determine whether a target application is vulnerable before attempting cache poisoning or authentication bypass.

What are the limitations of time-delay techniques for HTTP request smuggling detection?▼

Time-delay techniques for HTTP request smuggling detection rely on observable server response delays, which may vary based on network conditions and server architecture. This Skill combines timing analysis with header inspection to improve accuracy.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

mitmproxy

Intercepts, inspects, modifies and replays HTTP/HTTPS web traffic via Python-enabled scripting.

Community
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-http-smuggling

Detect HTTP request smuggling vulnerabilities by analyzing header parsing inconsistencies.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

request-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using Burp Suite or smuggler.py.

Official
Advanced
Logisoft-webLogisoft-web

SQL Injection Testing

Test web application parameters for SQL injection vulnerabilities using payloads.

Community
Advanced