aeondave/smuggler

smuggler

HTTP request smuggling / desync detection — CL.TE, TE.CL, TE.TE variants.

Quick Start

git clone https://github.com/defparam/smuggler
cd smuggler && pip3 install -r requirements.txt

# Single target
python3 smuggler.py -u https://target.com/endpoint

# Pipe a list of URLs
cat urls.txt | python3 smuggler.py

# Quiet mode (only show findings)
python3 smuggler.py -u https://target.com -q

# Exit on first finding per host
python3 smuggler.py -u https://target.com -x

Core Flags

| Flag | Purpose | |------|---------| | -u, --url <url> | Target URL with endpoint | | -v, --vhost <host> | Override Host header (virtual host) | | -x, --exit_early | Exit on first finding (useful in bulk mode) | | -m, --method <verb> | HTTP method (default: POST) | | -l, --log <file> | Write output to file + stdout | | -q, --quiet | Suppress non-finding output | | -t, --timeout <s> | Socket timeout (default: 5) | | --no-color | Suppress color codes (for piping/logs) | | -c, --configfile <file> | Custom payload config file |

Vulnerability Types Detected

| Type | Frontend | Backend | Description | |------|----------|---------|-------------| | CL.TE | Content-Length | Transfer-Encoding | Frontend routes by CL; backend parses chunked TE | | TE.CL | Transfer-Encoding | Content-Length | Frontend routes chunked; backend expects CL | | TE.TE | Transfer-Encoding | Transfer-Encoding | Both parse TE but one can be obfuscated |

How It Works

smuggler sends mutations of CL/TE headers to detect desync behavior via:

1. Timing attacks — a smuggled keep-alive request causes the connection to hang
2. Differential responses — subsequent request returns part of the smuggled request

Each mutation is sent with precise socket-level control (no HTTP libraries that auto-normalize headers).

Bulk Scan

# Using subfinder + httpx to build target list, then smuggle-test
subfinder -d target.com | httpx -silent | python3 smuggler.py -q -x

# From existing URL list
cat endpoints.txt | python3 smuggler.py -l smuggler-results.txt -q

Manual Verification with Repeater

After smuggler reports a potential issue, confirm manually in Burp Repeater:

# CL.TE probe — send with Connection: keep-alive
POST / HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked

0

X

If response is delayed or error changes between requests → real desync.

Common Exploitation Scenarios

# 1. Bypass front-end access controls
# Smuggle a request to a restricted path hidden in the body

# 2. Capture other users' requests
# Poison backend socket to prepend attacker-controlled prefix to next user's request

# 3. Cache poisoning
# Smuggle a request that causes malicious response to be cached for next user

# 4. Web cache deception
# Smuggle static-looking path to cache authenticated response

Important Note

smuggler can produce false positives on large CDN/proxy providers (Google, AWS, Akamai). Always manually verify before reporting or exploiting. Use -q -x in bulk scans to minimize noise.

References

• smuggler GitHub
• PortSwigger HTTP Request Smuggling Lab
• Payload configuration