skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

request-smuggling

Identify and test HTTP request smuggling and desync vulnerabilities across proxies, CDNs, and origin servers.

1.6k|204|Updated Apr 7, 2026
Search Tags:#cdn#proxy#security-testing#http2#desync#http-smuggling
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill request-smuggling-yaklang
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: request-smuggling
Source: https://github.com/yaklang/hack-skills/tree/main/skills/request-smuggling
Command: npx skills add https://github.com/yaklang/hack-skills --skill request-smuggling-yaklang

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

HTTP request smuggling and desynchronization testing exposes and assesses misinterpretations of HTTP message framing between front-end proxies and origin servers, enabling safer discovery of boundary-disagreement issues.

Core Features & Use Cases

  • Comprehensive technique coverage: CL.TE, TE.CL, TE.TE, H2 downgrade, and client-side desync methods.
  • Structured playbook: step-by-step probes, safe testing guidelines, and containment strategies for proxy/CDN topologies.
  • Use Case: Assess a web stack behind a CDN to reveal where request boundaries are inconsistently parsed, leading to potential bypass or cache poisoning.

Quick Start

Perform the CL.TE probe on a test target within authorized scope to confirm boundary misinterpretation.

Frequently Asked Questions about request-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is HTTP request smuggling and how does desync testing expose boundary issues?▼

HTTP request smuggling occurs when front-end proxies and origin servers disagree on message framing boundaries. Desync testing exposes this by sending ambiguous Content-Length and Transfer-Encoding headers to identify where request parsing misinterpretations occur.

How do I test for CL.TE and TE.CL request smuggling vulnerabilities?▼

You test CL.TE and TE.CL vulnerabilities by executing structured probes that send conflicting Content-Length and Transfer-Encoding headers. This identifies whether the front-end or back-end server prioritizes the wrong header, causing request boundary desynchronization.

Can I perform HTTP request smuggling testing on targets behind a CDN and proxy?▼

Yes, HTTP request smuggling testing applies to web stacks behind CDNs and proxies. It assesses front-end versus back-end boundary handling across proxy topologies to reveal inconsistent request parsing that can lead to bypass or cache poisoning.

Does HTTP request smuggling testing cover H2 downgrade and client-side desync techniques?▼

Yes, HTTP request smuggling testing covers H2 downgrade and client-side desync techniques. It assesses HTTP/2 protocol downgrades and client-side desynchronization methods alongside standard CL.TE, TE.CL, and TE.TE attack vectors across enterprise networks.

What is the best way to safely probe for HTTP desync vulnerabilities in authorized environments?▼

The best way to safely probe for HTTP desync vulnerabilities is using authorization-respecting probes with step-by-step guidance. This provides containment strategies and safe testing guidelines to assess proxy and CDN topologies without causing unintended disruption.

Related Skills

Explore More Software Engineering Skills→
YlikenYliken
5

request-smuggling

Detect and map HTTP request smuggling vulnerabilities across proxies and backends.

Community
Advanced
cybersecwomancybersecwoman
5

hunt-cache-poison

Analyze public bug bounty reports to identify cache poisoning attack vectors.

Community
Advanced
TheBushidoCollectiveTheBushidoCollective
187

PHP Security Patterns

Detect and prevent security vulnerabilities in PHP web applications.

Official
Advanced
jinyimeng01jinyimeng01
54

http-smuggling

Detect HTTP request smuggling vulnerabilities via CL.TE, TE.CL, and TE.TE testing.

Community
Advanced