skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

request-smuggling

Detect HTTP request smuggling vulnerabilities from message framing desynchronization.

96|1|Updated Jun 4, 2026
Search Tags:#penetration testing#web security#reverse proxy#http request smuggling#desynchronization#cl.te#te.cl
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill request-smuggling-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: request-smuggling
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/request-smuggling
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill request-smuggling-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses undetected HTTP request smuggling vulnerabilities caused by message framing disagreements between front proxies, CDNs, load balancers and origin servers, which can lead to WAF bypasses, cache poisoning, and authentication boundary breaches.

Core Features & Use Cases

  • Supports testing for CL.TE, TE.CL, and TE.TE obfuscation variants of classic HTTP/1.1 request smuggling.
  • Covers HTTP/2 downgrade smuggling and client-side desync via browser fetch pipelines.
  • Includes tool-assisted fuzzing guidance and a detection decision tree for structured security assessments. Use case: Penetration testers evaluating web applications behind reverse proxies or CDNs can use this Skill to identify desynchronization flaws that bypass access controls.

Quick Start

Use the request-smuggling skill to run a CL.TE probe against the target web application behind a reverse proxy to check for message framing desynchronization.

Frequently Asked Questions about request-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is HTTP request smuggling and how does message framing desynchronization happen?▼

HTTP request smuggling occurs when front proxies and origin servers disagree on message framing boundaries, allowing hidden requests to bypass WAFs, poison caches, and breach authentication boundaries. This desynchronization exploits differing interpretations of Content-Length and Transfer-Encoding headers.

How do I detect CL.TE and TE.CL request smuggling vulnerabilities?▼

Detect CL.TE and TE.CL request smuggling by probing reverse proxy topologies with tool-assisted fuzzing. Use a structured detection decision tree to identify message framing disagreements between front-end CDNs and back-end origin servers.

Can I test for HTTP/2 downgrade smuggling and client-side browser fetch desync?▼

Yes, you can test for HTTP/2 downgrade smuggling and client-side desync via browser fetch pipelines. This assessment identifies desynchronization flaws occurring when HTTP/2 connections are downgraded to HTTP/1.1 across reverse proxy topologies.

Does this request smuggling detection approach cover TE.TE obfuscation variants?▼

Yes, this request smuggling detection covers TE.TE obfuscation variants alongside CL.TE and TE.CL. It provides tool-assisted fuzzing procedures to identify these message framing desynchronization flaws between reverse proxies and origin servers.

When do I need to test for HTTP request smuggling vulnerabilities?▼

Test for HTTP request smuggling vulnerabilities when evaluating web applications deployed behind reverse proxies, CDNs, or load balancers. It is crucial for finding desynchronization flaws that bypass access controls and enable cache poisoning.

Related Skills

Explore More Software Engineering Skills→
TheBushidoCollectiveTheBushidoCollective
187

PHP Security Patterns

Detect and prevent security vulnerabilities in PHP web applications.

Official
Advanced
zebbernzebbern
4.5k

IDOR Vulnerability Testing

Identify and exploit IDOR vulnerabilities in web applications.

Community
Advanced
YlikenYliken
5

request-smuggling

Detect and map HTTP request smuggling vulnerabilities across proxies and backends.

Community
Advanced
utsavthakurutsavthakur

request-smuggling

Detects and analyzes HTTP desynchronization vulnerabilities across front-end to origin server topologies.

Community
Advanced