skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

web-vuln-http-smuggling

Detect HTTP request smuggling via timing and header-obfuscation probes.

21|1|Updated Apr 12, 2026
Search Tags:#web-security#curl#proxy#differential-analysis#netcat#http-request-smuggling#timing-probes
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-http-smuggling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-vuln-http-smuggling
Source: https://github.com/woohyun212/security-skill/tree/main/web-vuln-http-smuggling
Command: npx skills add https://github.com/woohyun212/security-skill --skill web-vuln-http-smuggling

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a structured methodology to discover and confirm HTTP request smuggling (desync) vulnerabilities that arise from parser disagreements between front-end proxies/CDNs and back-end servers, preventing cache poisoning, request hijacking, WAF bypass, and credential theft.

Core Features & Use Cases

  • Variant Coverage: Tests CL.TE, TE.CL, TE.TE, and H2.CL variants using timing probes, header obfuscation, and downgrade checks.
  • Practical Probes: Provides repeatable curl and netcat probe patterns plus guidance for Burp Suite automation to generate timing signals and differential responses.
  • Verification & Impact: Describes differential-response confirmation techniques and documents impact chains and proxy fingerprint indicators to support triage and reporting.
  • Use Case: Ideal for penetration testing or bug bounty assessments of web applications behind CDNs, load balancers, or reverse proxies where misframed requests can be abused.

Quick Start

Run the CL.TE timing probe against a POST endpoint behind a proxy and follow up any timing signals with differential response verification using curl or netcat.

Frequently Asked Questions about web-vuln-http-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect HTTP request smuggling vulnerabilities behind a reverse proxy?▼

Detect HTTP request smuggling by executing timing-based probes and header-obfuscation checks against targets behind reverse proxies or CDNs to identify parser disagreements between front-end and back-end servers.

What is the difference between CL.TE and TE.CL HTTP request smuggling?▼

HTTP request smuggling variants like CL.TE and TE.CL differ based on whether the front-end prioritizes Content-Length or Transfer-Encoding headers, causing desync; testing both identifies the specific parser disagreement.

How do I confirm HTTP request smuggling using curl and netcat?▼

Confirm HTTP request smuggling using curl and netcat by sending raw TCP framing with obfuscated Transfer-Encoding headers, then verifying differential responses to assess impact and validate the vulnerability.

Can I test for H2.CL request smuggling during a bug bounty assessment?▼

Yes, you can test for H2.CL request smuggling during bug bounty assessments using downgrade checks and timing probes to uncover desync vulnerabilities in web applications behind load balancers or CDNs.

Why does my HTTP request smuggling timing probe not return a differential response?▼

An HTTP request smuggling timing probe may not return a differential response if the proxy correctly parses headers, requiring obfuscated Transfer-Encoding tests or alternative variant checks to confirm the vulnerability.

When do I need to use netcat for HTTP request smuggling detection?▼

You need to use netcat for HTTP request smuggling detection when raw TCP framing is required to send precise, malformed requests that standard HTTP clients like curl may normalize or reject.

Related Skills

Explore More Software Engineering Skills→
Prohao42Prohao42
120

request-smuggling

Detect CL.TE, TE.CL, and HTTP/2 downgrade desynchronization between proxies and origins.

Community
Advanced
SkobynSkobyn

hunt-http-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using time-delay techniques.

Community
Advanced
gerald-icagerald-ica

Burp Suite Web Application Testing

Automate web application security testing with Burp Suite.

Community
Advanced
nirukk52nirukk52
1

e2e-testing

Automate ScreenGraph end-to-end UI validation with Playwright and .env configuration.

Community
Intermediate