domains / families / security / request-smuggling

request-smuggling

separate

HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.

When to use

• CL.TE smuggling
• TE.CL smuggling
• TE.TE obfuscation variants
• HTTP/2 downgrade attacks
• pseudo-header confusion
• client-side desync via browser fetch pipelines
• tool-assisted fuzzing

When not to use

• header injection
• Apache HttpClient <= 4.5.9 ghost-bits-cast-attack

Skill page

Source