hunt-http-smuggling

HTTP request smuggling vulnerabilities arise when front-end proxies and back-end servers disagree on request boundaries. This skill identifies and classifies CL.TE, TE.CL, H2.CL, and H2.TE vectors to reveal parsing mismatches that enable cache poisoning, authentication bypass, and data leakage.

Testing for CL.TE and TE.CL smuggling requires sending crafted payloads that manipulate Content-Length and Transfer-Encoding headers to observe how front-end and back-end servers parse request boundaries differently. Apply these payloads to CDN-fronted applications and load balancers to verify unsafe configurations.

Yes, H2.CL and H2.TE smuggling techniques specifically target HTTP/2 connections to exploit parsing differences between front-end and back-end servers. This skill assesses WAF and backend resilience against these request-smuggling chains in real-world red-team and bug-bounty engagement scenarios.

You can use Burp extensions, h2csmuggler, and related payloads to verify parsing behavior and identify unsafe configurations. These tools assist in detecting and classifying CL.TE, TE.CL, H2.CL, and H2.TE smuggling vectors across CDNs, load balancers, and origin servers during red-team workflows.

HTTP request smuggling happens because front-end proxies and back-end servers parse request boundaries differently when processing Content-Length and Transfer-Encoding headers. This boundary parsing disagreement allows attackers to smuggle hidden requests that bypass access controls and poison caches.