http-desync-guardian

Overview HTTP/1.1 went through a long evolution since 1991 to 2014: HTTP/0.9 – 1991 HTTP/1.0 – 1996 HTTP/1.1 RFC 2068 – 1997 RFC 2616 - 1999 RFC 7230 - 2014 This means there is a variety of servers and clients, which might have different views on request boundaries, creating opportunities for...

smuggler

/ | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to Ben Sadeghipour...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

CVE-2026-55613 uhttpd: HTTP request smuggling via ubus POST body parse-error desync

uhttpd is a small HTTP server. In unpatched repository snapshots, uhubusdatasend in ubus.c can desynchronize HTTP request boundaries when a POST /ubus JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets du-jsobj; a later segment takes the existing-object...

echteeteepee

HTTP/1 Desync Vulnerability Testing Tools This repository contains defensive security tools for detecting HTTP/1 request smuggling desync vulnerabilities based on groundbreaking research by James Kettle of PortSwigger. Research Attribution This work is directly inspired by and implements techniqu...

http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

CTT-Apple-Silicon-Refraction

CTT-Apple-Silicon-Refraction webkitrefraction.js The 33-Layer WebGL Payload ​This JavaScript payload uses the \alpha constant to create a high-frequency "Memory Shiver." It induces the Use-After-Free UAF in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal comman...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 SQL injection for unauthenticated remote code...

CVE-2022-22536_SAP_Request_Smuggling_Scanner

CVE-2022-22536 SAP Rquest Smuggling Scanner This is a fast, socket-level batch scanner for CVE-2022-22536 , a critical request smuggling vulnerability in SAP Internet Communication Manager ICM and SAP Web Dispatcher. It tests multiple hosts in parallel for protocol desynchronization behavior...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

crlf-desyncs

CRLF Desyncs This is a repository containing useful tools and resources for detecting and exploiting CRLF-based Desyncs, presented at BlackHat USA 2026 and DEFCON 34. Contents cdn-origin/ - contains aggregated origin-to-edge headers useful for fuzzing a CRLF injection on a response...

wp2shell

wp2shell — Pre-Auth RCE in WordPress core Unauthenticated WordPress core RCE PoC chaining CVE-2026-63030 + CVE-2026-60137. Authorized testing only. wp2shell.py is a single-file, standard-library-only proof of concept that chains two WordPress core vulnerabilities into unauthenticated remote code...

wp2shell-checker

\ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | WordPress Batch API Desync Detector Checker detector for the WordPress Core REST Batch API pre-auth RCE Created by 0xjessie21 — Cybersecurity ILCS Overview | ---|---...

CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS

Credits to @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main for details read: https://mizu.re/post/abusing-client-side-desync-on-werkzeug Tested On Chromium 119.0.6045.123 built on Debian trixie/sid, running on Debian kali-rolling...

crlf-powered-desync-scanner

CRLF-Powered Desync Scanner This is the Burp Extension we used to detect all cases from our research CRLF-Powered Desync Attacks: Beheading HTTP Streams. It's a research-first scanner built using BulkScan similar to HTTP Request Smuggler and others. Implementation Request Header Injection probe...

CVE-2026-116531: Improper Handling of Length Parameter Inconsistency

HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...

HFS CVE-2014-6287 search macro RCE

CVE-2014-6287 HttpFileServer 2.3–2.3c: NUL-byte desync in the search handler allows .exec|cmd. macro execution without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Rejetto HFS CVE-2014-6287 unauthenticated search macro command execution.""" from future import annotations from...

cve-2026-nextjs-use-cache-rce-poc

Next.js use cache typed-array desync → RCE GHSA-673q-mjm6-r...

GHSA-WJR9-J795-JXCR fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Impact fast-uri versions = 2.4.2, = 3.1.3, = 4.0.1, = 4.2.2 can silently rewrite the host of an HTTP-family URL http, https, ws, wss, or any scheme with domainHost: true. For those schemes canonicalizeHost passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking...