request-smuggling

You can detect HTTP request smuggling by utilizing differential testing to identify CL.TE, TE.CL, TE.TE, and HTTP/2 desync vulnerabilities across various proxy configurations. Specialized payloads reveal how servers interpret ambiguous requests differently.

Yes, HTTP request smuggling exploits desynchronization between a frontend proxy or WAF and the backend server. By smuggling malicious requests past the WAF, you can reach backend servers and bypass security controls directly.

HTTP/2 and HTTP/3 request desynchronization exploits discrepancies in how proxies and backend servers interpret request boundaries. This covers WebSocket and CONNECT method scenarios, enabling request hijacking and response queue poisoning.

You can exploit CL.TE and TE.CL vulnerabilities by sending specially crafted payloads that exploit differing Content-Length and Transfer-Encoding header interpretations to hijack requests and poison the response queue.

No specific dependencies are required to detect request smuggling. The approach targets various HTTP versions and proxy configurations natively, testing for desynchronization without needing external software libraries.

You should avoid HTTP request smuggling testing on production environments without authorization, as queue poisoning and request hijacking can disrupt other users by desynchronizing shared proxy connections and corrupting responses.