Menu
Auth/lab ref: HTTP/1.1 request smuggling and desync detection tool testing CL.TE, TE.CL, and TE.TE variants.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/AeonDave/malskill --skill smugglerThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | smuggler |
| description | Auth/lab ref: HTTP/1.1 request smuggling and desync detection tool testing CL.TE, TE.CL, and TE.TE variants. |
| license | MIT |
| compatibility | Linux / macOS / Windows; Python 3. |
| metadata | {"author":"AeonDave","version":"1.0"} |
HTTP request smuggling / desync detection — CL.TE, TE.CL, TE.TE variants.
git clone https://github.com/defparam/smuggler
cd smuggler && pip3 install -r requirements.txt
# Single target
python3 smuggler.py -u https://target.com/endpoint
# Pipe a list of URLs
cat urls.txt | python3 smuggler.py
# Quiet mode (only show findings)
python3 smuggler.py -u https://target.com -q
# Exit on first finding per host
python3 smuggler.py -u https://target.com -x
| Flag | Purpose |
|---|---|
-u, --url <url> | Target URL with endpoint |
-v, --vhost <host> | Override Host header (virtual host) |
-x, --exit_early | Exit on first finding (useful in bulk mode) |
-m, --method <verb> | HTTP method (default: POST) |
-l, --log <file> | Write output to file + stdout |
-q, --quiet | Suppress non-finding output |
-t, --timeout <s> | Socket timeout (default: 5) |
--no-color | Suppress color codes (for piping/logs) |
-c, --configfile <file> | Custom payload config file |
| Type | Frontend | Backend | Description |
|---|---|---|---|
| CL.TE | Content-Length | Transfer-Encoding | Frontend routes by CL; backend parses chunked TE |
| TE.CL | Transfer-Encoding | Content-Length | Frontend routes chunked; backend expects CL |
| TE.TE | Transfer-Encoding | Transfer-Encoding | Both parse TE but one can be obfuscated |
smuggler sends mutations of CL/TE headers to detect desync behavior via:
Each mutation is sent with precise socket-level control (no HTTP libraries that auto-normalize headers).
# Using subfinder + httpx to build target list, then smuggle-test
subfinder -d target.com | httpx -silent | python3 smuggler.py -q -x
# From existing URL list
cat endpoints.txt | python3 smuggler.py -l smuggler-results.txt -q
After smuggler reports a potential issue, confirm manually in Burp Repeater:
# CL.TE probe — send with Connection: keep-alive
POST / HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked
0
X
If response is delayed or error changes between requests → real desync.
# 1. Bypass front-end access controls
# Smuggle a request to a restricted path hidden in the body
# 2. Capture other users' requests
# Poison backend socket to prepend attacker-controlled prefix to next user's request
# 3. Cache poisoning
# Smuggle a request that causes malicious response to be cached for next user
# 4. Web cache deception
# Smuggle static-looking path to cache authenticated response
smuggler can produce false positives on large CDN/proxy providers (Google, AWS, Akamai). Always manually verify before reporting or exploiting. Use -q -x in bulk scans to minimize noise.