http-connection-request-smuggling

name

http-connection-request-smuggling

description

Detect and test HTTP Connection Request Smuggling vulnerabilities where reverse proxies only validate Host/:authority headers on the first request of a TCP/TLS connection. Use this skill whenever the user mentions HTTP smuggling, connection-state attacks, Host header validation, reverse proxy vulnerabilities, HTTP/2 coalescing abuse, or wants to test for SSRF-like access through connection reuse. Also trigger for requests about testing load balancers, CDNs, or proxies for first-request-only validation weaknesses.

HTTP Connection Request Smuggling Detection

This skill helps you detect and test HTTP Connection Request Smuggling vulnerabilities where reverse proxies, load balancers, or CDNs only validate Host or :authority headers on the first request of a connection, allowing attackers to smuggle requests to internal hosts.

When to Use This Skill

Use this skill when:

• Testing web applications behind reverse proxies, load balancers, or CDNs
• Investigating potential SSRF-like access through connection reuse
• Auditing HTTP/2 or HTTP/3 deployments for coalescing vulnerabilities
• Reviewing proxy configurations for first-request-only validation
• Analyzing responses that suggest requests are being routed to unexpected backends

Core Concepts

Connection-State Attack Vectors

1. First-request Validation: Proxies whitelist Host headers only on the first request
2. First-request Routing: Proxies map outbound connections based exclusively on the first request
3. HTTP/2/3 Coalescing Abuse: Browsers reuse TLS connections when certificate, ALPN, and IP match

Attack Pattern

Request 1 (allowed): Host: public.example.com
Request 2 (smuggled): Host: internal.company.local

If the proxy only validates the first request, Request 2 reaches the internal host.

Detection Workflow