| name | smuggler |
| description | Auth/lab ref: HTTP/1.1 request smuggling and desync detection tool testing CL.TE, TE.CL, and TE.TE variants. |
| license | MIT |
| compatibility | Linux / macOS / Windows; Python 3. |
| metadata | {"author":"AeonDave","version":"1.0"} |
smuggler
HTTP request smuggling / desync detection — CL.TE, TE.CL, TE.TE variants.
Quick Start
git clone https://github.com/defparam/smuggler
cd smuggler && pip3 install -r requirements.txt
python3 smuggler.py -u https://target.com/endpoint
cat urls.txt | python3 smuggler.py
python3 smuggler.py -u https://target.com -q
python3 smuggler.py -u https://target.com -x
Core Flags
| Flag | Purpose |
|---|
-u, --url <url> | Target URL with endpoint |
-v, --vhost <host> | Override Host header (virtual host) |
-x, --exit_early | Exit on first finding (useful in bulk mode) |
-m, --method <verb> | HTTP method (default: POST) |
-l, --log <file> | Write output to file + stdout |
-q, --quiet | Suppress non-finding output |
-t, --timeout <s> | Socket timeout (default: 5) |
--no-color | Suppress color codes (for piping/logs) |
-c, --configfile <file> | Custom payload config file |
Vulnerability Types Detected
| Type | Frontend | Backend | Description |
|---|
| CL.TE | Content-Length | Transfer-Encoding | Frontend routes by CL; backend parses chunked TE |
| TE.CL | Transfer-Encoding | Content-Length | Frontend routes chunked; backend expects CL |
| TE.TE | Transfer-Encoding | Transfer-Encoding | Both parse TE but one can be obfuscated |
How It Works
smuggler sends mutations of CL/TE headers to detect desync behavior via:
- Timing attacks — a smuggled keep-alive request causes the connection to hang
- Differential responses — subsequent request returns part of the smuggled request
Each mutation is sent with precise socket-level control (no HTTP libraries that auto-normalize headers).
Bulk Scan
subfinder -d target.com | httpx -silent | python3 smuggler.py -q -x
cat endpoints.txt | python3 smuggler.py -l smuggler-results.txt -q
Manual Verification with Repeater
After smuggler reports a potential issue, confirm manually in Burp Repeater:
# CL.TE probe — send with Connection: keep-alive
POST / HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked
0
X
If response is delayed or error changes between requests → real desync.
Common Exploitation Scenarios
# 1. Bypass front-end access controls
# Smuggle a request to a restricted path hidden in the body
# 2. Capture other users' requests
# Poison backend socket to prepend attacker-controlled prefix to next user's request
# 3. Cache poisoning
# Smuggle a request that causes malicious response to be cached for next user
# 4. Web cache deception
# Smuggle static-looking path to cache authenticated response
Important Note
smuggler can produce false positives on large CDN/proxy providers (Google, AWS, Akamai). Always manually verify before reporting or exploiting. Use -q -x in bulk scans to minimize noise.
References
