request-smuggling

HTTP request smuggling and desync technique list, including the 2025-26 "HTTP/1.1 must die" desync-endgame classes (0.CL, CL.0, H2.TE, TE.TE chunk extensions, response queue poisoning, dangling-byte, browser-powered desyncs). Converted from master-pentest-prompt.md Phase 4. Use when a target sits behind a reverse proxy/CDN/load balancer and front-end/back-end parsing discrepancies are worth probing.

Ir para a instalação

Repositório: ankitsingh015/HuntMCP
Última atividade na origem: 24 de agosto de 2026 às 11:04
Idioma detectado do SKILL.md: inglês
Estrelas: 4
Forks: 0

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/ankitsingh015/HuntMCP --skill request-smuggling

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

access-control-and-idor

Access-control technique list (IDOR, mass assignment, horizontal/vertical privilege escalation, GraphQL abuse, business-logic/money manipulation, race conditions) plus the explicit two-account IDOR testing procedure. Converted from master-pentest-prompt.md Phases 8/8.5. Use on any endpoint that returns or modifies user-specific data, and any multi-role application.

2026-08-26

csrf-cors-origin

CSRF token-bypass techniques, CORS misconfiguration patterns, postMessage origin issues, clickjacking, and WebSocket cross-origin hijacking. Converted from master-pentest-prompt.md Phase 10. Use on any state-changing request, any endpoint with CORS headers, and any page that could be framed.

2026-08-26

injection-and-rce

Full injection-class technique list (SQLi, command injection, LDAP/XPath/XSLT/EL, SSTI, CRLF, HPP, prototype pollution) and remote-code-execution technique list (deserialization, file-upload webshells, LFI/RFI, framework-specific RCE, dependency CVEs), plus concrete exploitation mechanics for SSTI-per-engine, unauthenticated Redis RCE, filename argument injection, and cloud-metadata-to-RCE chaining. Converted from master-pentest-prompt.md Phases 2/3. Use during scan-agent's injection-testing pass on any target with user-controlled input reaching a backend.

2026-08-26

Ver todas deste repositório

HTTP request smuggling / desync

When to use

Any target behind a reverse proxy, CDN, or load balancer -- the entire category depends on a front-end/back-end parser discrepancy existing, which is common in exactly that architecture. Worth a dedicated pass whenever httpx-mcp's recon shows a CDN/proxy signature (CF-RAY, X-Served-By, etc.).

Core techniques

CL.TE, TE.CL, TE.TE, H2.CL, H2.TE downgrade smuggling.

Front-end/back-end parser discrepancy detection.

Client-side desync (CSD) -- browser-level poisoning.

Response queue poisoning (steal victim responses).

CRLF in HTTP/2 header values (request splitting, CVE-2025-57804-class).

Chained: smuggling -> cache poisoning -> stored XSS served to all users.

Tools: Burp HTTP Request Smuggler v3.0 (Kettle), Turbo Intruder, Param Miner.

2025-26 desync-endgame classes (Kettle, "HTTP/1.1 must die")

0.CL desync: a request with zero body before Content-Length, plus the obfuscated Expect variant.

CL.0 (Content-Length without Transfer-Encoding) via Expect header, HEAD gadget, or 403-triggered CL.0.

V-H discrepancy: verify hops, defer to Host; H-V: trust Host, verify.

H2.TE (HTTP/2 -> HTTP/1.1 Transfer-Encoding conversion) and TE.0 dechunking.

TE.TE chunk extensions (obfuscating transfer-encoding).

Exotic desync triggers: Transfer-Encoding: gzip, multipart/byteranges, Range: ,, (comma), Expect:\t100-continue, Upgrade: websocket, CONNECT, Max-Forwards: 0, Early-data: 1 (TLS 1.3 early-data smuggling).

Response Queue Poisoning (RQP): poison the shared HTTP/1.1 queue.

Dangling-byte technique: a single trailing byte, race-free, fully reliable.

CRLF-powered desync: behead HTTP streams, desync worms (browser-compatible, self-replicating, no server cooperation needed), request splitting.

Browser-powered desyncs (fetch-compatible), connection-locked and IP-locked desyncs (use same-IP hosts to beat locking).

HTTP request tunnelling: blind desync into back-end tunnels.

Range Cache Poisoning + HEAD gadget: poison the cache of HEAD-only resources.

Automated discovery: HTTP Request Smuggler v3.0 / HTTP Terminator (Kettle/PortSwigger) for novel-class discovery on any target.

Working order

Start with single-request variants (no race needed), then move to RQP (targeted: send one queued victim request, observe queue replay).