http-request-smuggling

HTTP Request Smuggling Detection Tool

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability.

Analyze HTTP requests to minimize risks of HTTP Desync attacks (precursor for HTTP request smuggling/splitting).

Rust-powered HTTP Request Smuggling Scanner.

HTTP request smuggling attack helper/CLI tools to manipulate HTTP packets

HTTP3ONSTEROIDS - A research on CVE-2023-25950 where HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name.

HTTP header security scanner. Finds Host header injection, web cache poisoning, request smuggling and unkeyed-input gadgets, assesses HSTS/CSP/cookie posture, confirms every finding with a second probe, maps it to OWASP ASVS 5.0 and PCI DSS 4.0.1 — and reports what it could not assess instead of counting it as a pass.

Burp Suite Pro extension (Montoya API): HTTP request-smuggling / desync hypothesis scanner with a framing-aware, oracle-free classifier and Burp Collaborator OOB (SSRF) detection.

HTTP request smuggling examples

HTTP Request Smuggling Payload List

CLTEcho is an advanced HTTP Request Smuggling detection suite featuring AI-powered analysis, concurrent scanning, and comprehensive reporting. With 6 threat detection types, ML-based anomaly detection, HTTP/2 support, and WAF bypass techniques, it delivers enterprise-grade security testing with professional HTML/JSON reports for security researcher

Golang HTTP echo server (real raw request echoed)

👹 See past every gate. 318 verified HTTP bypass mutations behind a 6-gate zero-false-positive pipeline. Authorized bug bounty recon & 403/WAF bypass engine.

Personal TryHackMe write-ups, notes and methodologies covering web application penetration testing, vulnerability discovery, exploitation and remediation.

Notes from TryHackMe's Web Application Pentesting path. Goes beyond OWASP Top 10 basics into JWT and OAuth attacks, NoSQL/XXE/SSTI/LDAP injection, SSRF, insecure deserialization, and HTTP request smuggling across HTTP/1.1, HTTP/2, and WebSockets, with full kill chain writeups for each module's challenge room.

Web reconnaissance & cache-deception attack-chain tooling for authorized CTF / lab testing

Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3

Team MCU · FMxAI Vibecheck 2026: three formally-verified demos — HTTP parser differentials, multi-accident fault-analysis walk-throughs (737 MAX/TMI/Therac-25/Cloudflare), and a Lean-backed tax-policy cliff lab.

CVE-2026-59903 / CVE-2026-33870: offline checker for io.netty:netty-codec-http - its 14 CVEs plus 9 advisories Netty published on 2026-09-10 that the GitHub Advisory Database (Dependabot) does not list. 4.1.137.Final / 4.2.17.Final is no longer enough; upgrade to 4.1.138.Final / 4.2.18.Final.