hunt-http-smuggling

Name: hunt-http-smuggling
Author: elementalsouls

3.0kstars461forks

How to install hunt-http-smuggling?

elementalsouls/claude-bughunter/hunt-http-smuggling

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-http-smuggling

Installs into the current project.

Summary

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by send

Files · 1

View on GitHub

SKILL.md

1	## 17. HTTP REQUEST SMUGGLING
2	> Lowest dup rate. $5K–$30K. PortSwigger research by James Kettle.
3
4	### CL.TE (Content-Length front, Transfer-Encoding back)
5	```http
6	POST / HTTP/1.1
7	Content-Length: 13
8	Transfer-Encoding: chunked
9
10	0
11
12	SMUGGLED
13	```
14
15	### Detection
16	```
17	1. Burp extension: HTTP Request Smuggler
18	2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe
19	3. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body
20	```
21
22	### Impact Chain
23	```
24	Poison next request → access admin as victim
25	Steal credentials → capture victim's session
26	Cache poisoning → stored XSS at scale
27	```
28
29	---
30
31	## Target-Suitability Matrix (2026 reality check)
32
33	The classic CL.TE / TE.CL payloads are NOT universally exploitable in 2026. Modern proxies are RFC 9112 strict by default. Fingerprint the front-end BEFORE investing time.
34
35	\| Front-end \| CL.TE \| TE.CL \| H2.CL \| H2.TE \| Notes \|
36	\|---\|---\|---\|---\|---\|---\|
37	\| Nginx ≥ 1.21 \| NO \| NO \| partial (H2 ingress) \| partial \| RFC-strict; rejects CL+TE with HTTP 400. Verified locally on Nginx 1.27 — all 9 documented variants killed by front-end ([docs/verification/phase2h-smuggling-cachepoison.md](../../docs/verification/phase2h-smuggling-cachepoison.md)). \|
38	\| Caddy 2.x \| NO \| NO \| — \| — \| Hardened by default \|
39	\| Envoy ≥ 1.20 \| NO \| NO \| partial \| partial \| Hardened in most paths \|
40	\| HAProxy ≤ 2.4 \| ✓ \| ✓ \| — \| — \| Vulnerable, see CVE-2021-40346 \|
41	\| AWS ALB + specific upstream \| partial \| partial \| ✓ \| ✓ \| Several disclosed-paid reports 2022-2024 \|
42	\| Cloudflare → S3 / Lambda chains \| — \| — \| ✓ \| ✓ \| H2-downgrade attacks remain viable \|
43	\| Older F5 BIG-IP (TMM < 16) \| ✓ \| — \| — \| — \| Vendor advisories \|
44	\| Citrix ADC / NetScaler (older firmware) \| ✓ \| ✓ \| — \| — \| Disclosed in 2020-2022 \|
45	\| Squid 3.x \| ✓ \| — \| — \| — \| Older deployments \|
46	\| Apache Traffic Server (older) \| ✓ \| ✓ \| ✓ \| ✓ \| PortSwigger research \|
47	\| Custom Python / Go proxies \| ✓ \| ✓ \| — \| — \| Frequently miss RFC enforcement \|
48
49	### Operator fingerprint quick-check
50
51	```bash
52	curl -sI https://target/ \| grep -i "Server:"
53	```
54
55	- `nginx/1.21+`, `Caddy`, `envoy` → CL/TE classic is dead — pivot to H2.CL/H2.TE if the front-end speaks HTTP/2, or look for legacy proxies upstream
56	- `HAProxy`, header points to AWS/CDN → run the full payload matrix
57	- No Server header → assume hardened, but run a single quick `space-before-colon` probe; if it doesn't 400, dig deeper
58
59	### H2.CL / H2.TE (the modern dominant vector)
60
61	H2-downgrade smuggling attacks rely on the front-end speaking HTTP/2 to the client and HTTP/1.1 to origin. The downgrade introduces CL/TE confusion because HTTP/2's frame-length headers don't survive the conversion cleanly. Most CDN+origin chains in 2024-2026 use this exact topology.
62
63	Tools that send HTTP/2 raw frames (Burp Pro's HTTP Request Smuggler extension, `h2csmuggler`, `smuggler.py`) are the right starting point against CDN-fronted targets. Avoid HTTP/1.1-only test clients (curl, raw sockets) against H2-front-ended targets — you'll send the wrong protocol entirely.
64
65	---
66
67	## Related Skills & Chains
68
69	- `hunt-cache-poison` — Smuggling + cache is the canonical critical chain; one smuggled request becomes the cached response for every subsequent victim. Chain primitive: CL.TE smuggle a request whose response body contains attacker HTML/JS → front-end cache stores it under a popular URL (`/`, `/login`) → de-sync poisoning where the smuggled request becomes the cached response for the next N victims, persisting for the cache TTL.
70	- `hunt-auth-bypass` — Smuggling reaches internal-only routes that the front-end WAF/auth-proxy filters out. Chain primitive: smuggle `GET /admin/users HTTP/1.1` past the front-end ACL that blocks external `/admin/*` → backend processes the smuggled request as if from a trusted internal source → bypass front-end auth by smuggling internal-routed request → admin data in the response queue.
71	- `hunt-idor` — Smuggling

People who liked this also viewed

6 picks

Type

hunt-http-smuggling

3.0kstars461forks

View on GitHub

How to install hunt-http-smuggling?

elementalsouls/claude-bughunter/hunt-http-smuggling

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-http-smuggling

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## 17. HTTP REQUEST SMUGGLING
2	> Lowest dup rate. $5K–$30K. PortSwigger research by James Kettle.
3
4	### CL.TE (Content-Length front, Transfer-Encoding back)
5	```http
6	POST / HTTP/1.1
7	Content-Length: 13
8	Transfer-Encoding: chunked
9
10	0
11
12	SMUGGLED
13	```
14
15	### Detection
16	```
17	1. Burp extension: HTTP Request Smuggler
18	2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe
19	3. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body
20	```
21
22	### Impact Chain
23	```
24	Poison next request → access admin as victim
25	Steal credentials → capture victim's session
26	Cache poisoning → stored XSS at scale
27	```
28
29	---
30
31	## Target-Suitability Matrix (2026 reality check)
32
33	The classic CL.TE / TE.CL payloads are NOT universally exploitable in 2026. Modern proxies are RFC 9112 strict by default. Fingerprint the front-end BEFORE investing time.
34
35	\| Front-end \| CL.TE \| TE.CL \| H2.CL \| H2.TE \| Notes \|
36	\|---\|---\|---\|---\|---\|---\|
37	\| Nginx ≥ 1.21 \| NO \| NO \| partial (H2 ingress) \| partial \| RFC-strict; rejects CL+TE with HTTP 400. Verified locally on Nginx 1.27 — all 9 documented variants killed by front-end ([docs/verification/phase2h-smuggling-cachepoison.md](../../docs/verification/phase2h-smuggling-cachepoison.md)). \|
38	\| Caddy 2.x \| NO \| NO \| — \| — \| Hardened by default \|
39	\| Envoy ≥ 1.20 \| NO \| NO \| partial \| partial \| Hardened in most paths \|
40	\| HAProxy ≤ 2.4 \| ✓ \| ✓ \| — \| — \| Vulnerable, see CVE-2021-40346 \|
41	\| AWS ALB + specific upstream \| partial \| partial \| ✓ \| ✓ \| Several disclosed-paid reports 2022-2024 \|
42	\| Cloudflare → S3 / Lambda chains \| — \| — \| ✓ \| ✓ \| H2-downgrade attacks remain viable \|
43	\| Older F5 BIG-IP (TMM < 16) \| ✓ \| — \| — \| — \| Vendor advisories \|
44	\| Citrix ADC / NetScaler (older firmware) \| ✓ \| ✓ \| — \| — \| Disclosed in 2020-2022 \|
45	\| Squid 3.x \| ✓ \| — \| — \| — \| Older deployments \|
46	\| Apache Traffic Server (older) \| ✓ \| ✓ \| ✓ \| ✓ \| PortSwigger research \|
47	\| Custom Python / Go proxies \| ✓ \| ✓ \| — \| — \| Frequently miss RFC enforcement \|
48
49	### Operator fingerprint quick-check
50
51	```bash
52	curl -sI https://target/ \| grep -i "Server:"
53	```
54
55	- `nginx/1.21+`, `Caddy`, `envoy` → CL/TE classic is dead — pivot to H2.CL/H2.TE if the front-end speaks HTTP/2, or look for legacy proxies upstream
56	- `HAProxy`, header points to AWS/CDN → run the full payload matrix
57	- No Server header → assume hardened, but run a single quick `space-before-colon` probe; if it doesn't 400, dig deeper
58
59	### H2.CL / H2.TE (the modern dominant vector)
60
61	H2-downgrade smuggling attacks rely on the front-end speaking HTTP/2 to the client and HTTP/1.1 to origin. The downgrade introduces CL/TE confusion because HTTP/2's frame-length headers don't survive the conversion cleanly. Most CDN+origin chains in 2024-2026 use this exact topology.
62
63	Tools that send HTTP/2 raw frames (Burp Pro's HTTP Request Smuggler extension, `h2csmuggler`, `smuggler.py`) are the right starting point against CDN-fronted targets. Avoid HTTP/1.1-only test clients (curl, raw sockets) against H2-front-ended targets — you'll send the wrong protocol entirely.
64
65	---
66
67	## Related Skills & Chains
68
69	- `hunt-cache-poison` — Smuggling + cache is the canonical critical chain; one smuggled request becomes the cached response for every subsequent victim. Chain primitive: CL.TE smuggle a request whose response body contains attacker HTML/JS → front-end cache stores it under a popular URL (`/`, `/login`) → de-sync poisoning where the smuggled request becomes the cached response for the next N victims, persisting for the cache TTL.
70	- `hunt-auth-bypass` — Smuggling reaches internal-only routes that the front-end WAF/auth-proxy filters out. Chain primitive: smuggle `GET /admin/users HTTP/1.1` past the front-end ACL that blocks external `/admin/*` → backend processes the smuggled request as if from a trusted internal source → bypass front-end auth by smuggling internal-routed request → admin data in the response queue.
71	- `hunt-idor` — Smuggling

People who liked this also viewed

6 picks

Type