hunt-http-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using time-delay techniques.

Updated Jun 24, 2026

Search Tags:#vulnerability detection #web application security #security assessment #http request smuggling #network exploitation

Ready to run

npx skills add https://github.com/Skobyn/talon --skill hunt-http-smuggling-skobyn

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-http-smuggling
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-http-smuggling
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-http-smuggling-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Burp Suite, smuggler.py, h2csmuggler, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and exploit HTTP request smuggling vulnerabilities in web applications, which occur when front-end and back-end servers disagree on where one request ends and the next begins.

Core Features & Use Cases

Detection: Identifies HTTP request smuggling vectors like CL.TE, TE.CL, H2.CL, and H2.TE.
Impact Analysis: Provides potential impact scenarios such as poison cache, steal credentials, or bypass authentication.
Target Suitability: Assesses target suitability based on front-end and back-end server configurations.
Tools and Techniques: Offers guidance on using tools like Burp HTTP Request Smuggler, smuggler.py, and h2csmuggler for detection.

Quick Start

Use the hunt-http-smuggling skill to scan for HTTP request smuggling vulnerabilities in the target application.

Frequently Asked Questions about hunt-http-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect HTTP request smuggling vulnerabilities in web applications?▼

HTTP request smuggling vulnerabilities are detected by analyzing server header responses and applying time-delay techniques to find front-end and back-end server disagreements. This Skill identifies CL.TE, TE.CL, H2.CL, and H2.TE vectors.

What is HTTP request smuggling and how does it impact web security?▼

HTTP request smuggling occurs when front-end and back-end servers disagree on request boundaries. This Skill validates impact through cache poisoning, credential theft, and authentication bypass scenarios to assess web application security risks.

How do I use Burp Suite and smuggler.py for HTTP request smuggling detection?▼

Burp HTTP Request Smuggler, smuggler.py, and h2csmuggler are used for detecting smuggling vectors. This Skill provides guidance on leveraging these tools to scan target applications and analyze server configurations for vulnerabilities.

Can I assess target suitability for HTTP request smuggling before exploitation?▼

Target suitability for HTTP request smuggling is assessed by evaluating front-end and back-end server configurations. This Skill helps determine whether a target application is vulnerable before attempting cache poisoning or authentication bypass.

What are the limitations of time-delay techniques for HTTP request smuggling detection?▼

Time-delay techniques for HTTP request smuggling detection rely on observable server response delays, which may vary based on network conditions and server architecture. This Skill combines timing analysis with header inspection to improve accuracy.