| name | pentest-http-smuggling |
| description | HTTP request smuggling, desync attacks, cache poisoning, and protocol-level vulnerability testing. |
Pentest HTTP Smuggling
Purpose
Detect and exploit discrepancies between front-end proxies and back-end servers in HTTP request parsing. These attacks bypass security controls, poison caches, and hijack requests — entirely absent from standard taint analysis pipelines.
Prerequisites
Authorization Requirements
- Written authorization with explicit scope for protocol-level testing
- Infrastructure awareness — identify all reverse proxies, CDNs, load balancers in path
- Rollback plan for cache poisoning tests (CDN purge access)
- Emergency contacts for infrastructure team (smuggling can affect other users)
Environment Setup
- Python 3.x with raw socket capability for crafted HTTP requests
- Burp Suite Professional with HTTP Request Smuggler extension
- curl compiled with HTTP/2 support (
--http2-prior-knowledge)
- Turbo Intruder for timing-sensitive attacks
- Network capture tool (Wireshark/tcpdump) for response analysis
Core Workflow
- Stack Fingerprinting: Identify reverse proxies (nginx, HAProxy, Cloudflare, AWS ALB), CDNs, load balancers. Determine HTTP version support (HTTP/1.1, HTTP/2) and parsing behavior.
- CL.TE Smuggling: Craft requests where front-end uses Content-Length and back-end uses Transfer-Encoding. Observe differential parsing and request boundary confusion.
- TE.CL Smuggling: Reverse scenario — front-end uses Transfer-Encoding, back-end uses Content-Length. Test with obfuscated TE headers.
- TE.TE Smuggling: Both sides use Transfer-Encoding but one can be confused with header obfuscation (capitalization, whitespace, duplicate headers).
