HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.
An expert playbook for HTTP request smuggling and desynchronization testing, for authorized security assessments of layered HTTP infrastructure. The core idea is message-boundary disagreement: when a front-end proxy, CDN, or load balancer and the origin server parse where one request ends and the next begins differently within the same TCP/TLS stream, an attacker can embed a partial or full second request inside one logical request. The skill is explicit that this is not header injection; it targets RFC 7230 framing differences between Content-Length and Transfer-Encoding.
It opens with concrete first probes for the two classic patterns. CL.TE assumes the front end trusts Content-Length while the back end trusts chunked encoding, using a short Content-Length so the front end accepts a fake end while the back end leaves bytes buffered for the next request. TE.CL reverses the roles, with a byte-precise chunked payload embedding a second request. A dedicated section enumerates eight TE.TE obfuscation variants, including malformed or duplicated Transfer-Encoding headers, tabs, leading spaces, and split field names, to find parser differentials between hops.
Beyond HTTP/1.1 framing, the material covers HTTP/2 downgrade and pseudo-header confusion and client-side desync via browser fetch pipelines. The documented impact includes WAF rule bypass because the smuggled body is invisible to the front end, hijacking other users' requests through queue poisoning, cache-poisoning assistance, and authentication-boundary confusion. Throughout, it stresses staying within authorized scope, warning that concurrent smuggling can poison connection pools, corrupt caches, or affect other tenants, and it recommends isolated environments or low-traffic windows.
It is a message-boundary disagreement where two or more HTTP processing entities parse where one request ends and the next begins differently within the same TCP/TLS stream, letting an attacker embed a second request inside one logical request.
CL.TE and TE.CL framing mismatches, eight TE.TE obfuscation variants for finding parser differentials, HTTP/2 downgrade and pseudo-header confusion, and client-side desync via browser fetch pipelines.
CRLF injection targets responses or header lines, whereas smuggling exploits implementation differences in RFC 7230 message framing between Content-Length and chunked Transfer-Encoding.
WAF rule bypass (the smuggled body is not visible to the front end), hijacking other users' requests through queue poisoning, cache-poisoning assistance, and authentication-boundary confusion.
Test only within authorized scope, since concurrent smuggling can poison connection pools, corrupt caches, or impact other tenants; prefer isolated environments or low-traffic windows.
Quick Setup:
.claude/skills/Repository
yaklang/hack-skills