http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

http-request-smuggling

HTTP Request Smuggling Detection Tool HTTP request smuggling is a high severity vulnerability which is a technique where an attacker smuggles an ambiguous HTTP request to bypass security controls and gain unauthorized access to performs malicious activities, the vulnerability was discovered back ...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

smugglex

Rust-powered HTTP Request Smuggling Scanner. Overview Smugglex is a security testing tool that detects HTTP Request Smuggling vulnerabilities in web applications. It tests for CL.TE, TE.CL, TE.TE, H2C, and H2 smuggling attacks, and — on HTTPS targets — speaks real HTTP/2 ALPN h2 to detect...

CVE-2023-25690_lab

HTTP Request Smuggling via Apache proxy Environment Setup Infrastructure...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler Una herramienta de prueba de HTTP Request Smuggling / Desync escrita en Python 3 Agradecimientos Un agradecimiento especial a James Kettle por su investigación y métodos sobre...

http2smugl

http2smugl Esta herramienta ayuda a detectar y explotar el contrabando de solicitudes HTTP en aquellos casos en que se puede lograr mediante la conversión HTTP/2 - HTTP/1.1 por parte del servidor frontend. El esquema es el siguiente: 1. Un atacante envía una solicitud HTTP/2 manipulada al servido...

http2smugl

http2smugl This tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 - HTTP/1.1 conversion by the frontend server. The scheme is as follows: 1. An attacker sends a crafted HTTP/2 request to the target server, which we call frontend. 2. The request is...

CVE-2024-40725-CVE-2024-40898

🚨Alert🚨Apache Vulnerability 🚨Alert🚨Security Advisory: CVE-2024-40725 and CVE-2024-40898🚨Alert🚨 CVE-2024-40725 Description: CVE-2024-40725 is a high-severity vulnerability found in Apache HTTP Server versions 2.4.0 to 2.4.61. This vulnerability affects the modproxy module. When the ProxyPass...

CTF-Web-Exploitation

Nether Portal Desync HUUP "I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep." Description The challenge features an HTTP/3 QUIC application layered over UDP. Because UDP is stateless and the proxy doesn't enforce...

CVE-2025-23167

CVE-2025-23167 – Node.js HTTP Request Smuggling Exploit Working exploit for CVE-2025-23167, a request smuggling vulnerability affecting Node.js 20.x versions prior to v20.19.2. This bug allows improper HTTP header termination, enabling attackers to bypass proxy-based access controls. Files...

CVE-2025-55315

CVE-2025-55315 Proof-of-concept exploit for CVE-2025-55315 .NET HTTP Request Smuggling. Demonstrates how improperly parsed chunked encoding lets attackers smuggle requests past proxies and load balancers in vulnerable ASP.NET Core/Kestrel servers. 📊 Presentation View Interactive Prezi Presentatio...

Qlik Sense Enterprise - HTTP Request Smuggling

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunnelin...

CVE-2021-40346

CVE-2021-40346 Integer overflow on header request internal representation allows HTTP request smuggling. This repository presents a PoC built with docker-compose using two docker images: one with a vulnerable version of HaProxy in this case 2.2.16 and one with a Flask web server using Gunicorn as...

CVE-2023-25690

CVE-2023-25690 Description of CVE-2023-25690: Some modproxy configurations on Apache HTTP Server from version 2.4.0 to 2.4.55 allow HTTP Request Smuggling attacks a technique that interferes with the way a website processes HTTP request sequences received from one or more users. These...

CVE-2026-33555

HTTP Request Smuggling via HAProxy H3/QUIC Standalone FIN Body Validation Bypass Full post here : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Summary A vulnerability in HAProxy's HTTP/3 implementation allows an attacker to send an HTTP request with a...

CVE-2025-55315-Scanner-Monitor

CVE-2025-55315 Vulnerability Scanner and TLS Proxy This repository contains tools to detect and monitor ASP.NET Core applications vulnerable to CVE-2025-55315, which involves HTTP request smuggling due to conflicting HTTP headers. Tools Included 1. Python Vulnerability Scanner...

http-request-smuggling

Herramienta de Detección de Contrabando de Solicitudes HTTP El contrabando de solicitudes HTTP es una vulnerabilidad de alta gravedad que consiste en una técnica donde un atacante introduce de forma encubierta una solicitud HTTP ambigua para eludir los controles de seguridad y obtener acceso no...

CVE-2026-66752-HTTP-Request-Smuggling-via-Unparsed-Transfer-Encoding-Values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values tinyhttp Assigned CVE ID: CVE-2026-66752 Summary tinyhttp checks only whether a Transfer-Encoding header is present. It never looks at the value. Any value, including codings that are not chunked and coding lists whos...