request-smuggling

HTTP request smuggling and desync technique list, including the 2025-26 "HTTP/1.1 must die" desync-endgame classes (0.CL, CL.0, H2.TE, TE.TE chunk extensions, response queue poisoning, dangling-byte, browser-powered desyncs). Converted from master-pentest-prompt.md Phase 4. Use when a target sits behind a reverse proxy/CDN/load balancer and front-end/back-end parsing discrepancies are worth probing.

Zur Installation springen

Repository: ankitsingh015/HuntMCP
Letzte Quellaktivität: 24. August 2026 um 11:04
Erkannte Sprache von SKILL.md: Englisch
Sterne: 4
Forks: 0

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/ankitsingh015/HuntMCP --skill request-smuggling

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

access-control-and-idor

Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md Phases 8/8.5. Use on any endpoint that returns or modifies user-specific data, and any multi-role application.

2026-08-26

csrf-cors-origin

CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers, and any page that could be framed.

2026-08-26

injection-and-rce

Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus concrete exploitation mechanics for SSTI-per-engine, unauthenticated Redis RCE, filename argument injection, and cloud-metadata-to-RCE chaining. Converted from master-pentest-prompt.md Phases 2/3. Use during scan-agent's injection-testing pass on any target with user-controlled input reaching a backend.

2026-08-26

Alle aus diesem Repository ansehen

HTTP request smuggling / desync

When to use

Any target behind a reverse proxy, CDN, or load balancer -- the entire category depends on a front-end/back-end parser discrepancy existing, which is common in exactly that architecture. Worth a dedicated pass whenever httpx-mcp's recon shows a CDN/proxy signature (CF-RAY, X-Served-By, etc.).

Core techniques

CL.TE, TE.CL, TE.TE, H2.CL, H2.TE downgrade smuggling.

Front-end/back-end parser discrepancy detection.

Client-side desync (CSD) -- browser-level poisoning.

Response queue poisoning (steal victim responses).

CRLF in HTTP/2 header values (request splitting, CVE-2025-57804-class).

Chained: smuggling -> cache poisoning -> stored XSS served to all users.

Tools: Burp HTTP Request Smuggler v3.0 (Kettle), Turbo Intruder, Param Miner.

2025-26 desync-endgame classes (Kettle, "HTTP/1.1 must die")

0.CL desync: a request with zero body before Content-Length, plus the obfuscated Expect variant.

CL.0 (Content-Length without Transfer-Encoding) via Expect header, HEAD gadget, or 403-triggered CL.0.

V-H discrepancy: verify hops, defer to Host; H-V: trust Host, verify.

H2.TE (HTTP/2 -> HTTP/1.1 Transfer-Encoding conversion) and TE.0 dechunking.

TE.TE chunk extensions (obfuscating transfer-encoding).

Exotic desync triggers: Transfer-Encoding: gzip, multipart/byteranges, Range: ,, (comma), Expect:\t100-continue, Upgrade: websocket, CONNECT, Max-Forwards: 0, Early-data: 1 (TLS 1.3 early-data smuggling).

Response Queue Poisoning (RQP): poison the shared HTTP/1.1 queue.

Dangling-byte technique: a single trailing byte, race-free, fully reliable.

CRLF-powered desync: behead HTTP streams, desync worms (browser-compatible, self-replicating, no server cooperation needed), request splitting.

Browser-powered desyncs (fetch-compatible), connection-locked and IP-locked desyncs (use same-IP hosts to beat locking).

HTTP request tunnelling: blind desync into back-end tunnels.

Range Cache Poisoning + HEAD gadget: poison the cache of HEAD-only resources.

Automated discovery: HTTP Request Smuggler v3.0 / HTTP Terminator (Kettle/PortSwigger) for novel-class discovery on any target.

Working order

Start with single-request variants (no race needed), then move to RQP (targeted: send one queued victim request, observe queue replay).