skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-http-smuggling

Detects HTTP request smuggling vulnerabilities in front-end/back-end header parsing mismatches.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#bug bounty#http smuggling#cache poisoning#cdn security#load balancer testing#h2 downgrade
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-http-smuggling-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-http-smuggling
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-http-smuggling
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-http-smuggling-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the challenge of identifying HTTP request smuggling vulnerabilities, a high-impact, low-duplicate bug class that yields $5K–$30K bounties on public programs, while accounting for modern proxy hardening that has rendered classic CL.TE/TE.CL payloads ineffective against 2024–2026 stacks.

Core Features & Use Cases

  • Stack-Aware Testing Matrix: Provides a pre-verified suitability table for common frontends (Nginx, Caddy, Envoy, HAProxy, AWS ALB, Cloudflare, etc.) to avoid wasting time on patched stacks and prioritize viable attack vectors.
  • Full Modern Variant Coverage: Includes detection and validation techniques for all current smuggling types: H2.CL/H2.TE HTTP/2 downgrade attacks, CL.0 desync, TE.TE header obfuscation, and legacy CL.TE/TE.CL for older proxy deployments.
  • Real-World Impact Guidance: Features confirmed case studies (Netflix $20K H2.CL bounty, AWS ALB H2.TE disclosure) and exploit chain primitives for cache poisoning, credential theft, and auth bypass to turn detected flaws into valid, high-severity reports.
  • Use Case: Bug bounty hunters and penetration testers targeting H1 programs with CDN+origin or load balancer architectures can use this Skill to systematically uncover smuggling flaws that automated scanners often miss.

Quick Start

Use the hunt-http-smuggling skill to test a target CDN-fronted application for HTTP request smuggling vulnerabilities, starting with stack fingerprinting to select the correct probe variants for the detected frontend proxy.

Frequently Asked Questions about hunt-http-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect HTTP request smuggling vulnerabilities in CDN-fronted applications?▼

To test for HTTP request smuggling, you fingerprint the frontend proxy stack to select suitable probe variants, then validate CL.TE, TE.CL, or H2 downgrade desync attacks using tools like Burp Suite and smuggler.py against the target.

Does HTTP request smuggling work against modern stacks like AWS ALB and Cloudflare?▼

Classic CL.TE and TE.CL smuggling payloads are often ineffective against modern 2024–2026 stacks like AWS ALB and Cloudflare, but H2 downgrade attacks and CL.0 desync variants can still bypass these hardened proxy configurations.

What is an H2 downgrade attack in the context of HTTP request smuggling?▼

An H2 downgrade attack exploits HTTP/2 to HTTP/1.1 protocol conversion inconsistencies, specifically H2.CL and H2.TE variants, to smuggle requests past modern proxies that fail to properly validate translated headers on the backend.

Can I use Burp Suite to validate HTTP/2 smuggling variants like H2.CL?▼

Yes, Burp Suite combined with h2csmuggler validates modern H2.CL and H2.TE HTTP/2 downgrade smuggling variants by sending crafted HTTP/2 requests to detect desync behavior in the backend server.

How do I turn detected HTTP request smuggling flaws into high-severity bug bounty reports?▼

Detected HTTP smuggling flaws are escalated to high-severity bug bounty reports by chaining exploit primitives for cache poisoning, credential theft, and authentication bypass, demonstrating real-world impact similar to confirmed cases like the Netflix H2.CL bounty.

Why does my HTTP request smuggling scanner miss vulnerabilities on load balancer targets?▼

Automated scanners often miss HTTP request smuggling flaws on load balancer targets because they fail to perform stack-aware fingerprinting and do not test modern H2 downgrade or CL.0 desync variants required to bypass patched proxies.

Related Skills

Explore More Software Engineering Skills→
jellaharshithjellaharshith
1

hunt-http-smuggling

Detect HTTP request smuggling via front-end and back-end parser inconsistencies.

Community
Advanced
SkobynSkobyn

hunt-http-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using time-delay techniques.

Community
Advanced
chatbotkitchatbotkit
13

hunt-http-smuggling

Detect HTTP request smuggling variants using Burp extension and time-delay techniques.

Official
Advanced
sseshachalasseshachala

hunt-http-smuggling

Detect and classify CL.TE, TE.CL, H2.CL, and H2.TE HTTP request smuggling vectors.

Community
Advanced