HTTP Request Smuggling Practical Handbook

Problem being addressed

When a CDN, reverse proxy, and origin do not agree on where one HTTP request ends, a single logical request can be split into multiple requests or swallow bytes from a later request. This can produce abnormal request concatenation, cache-key misalignment, cross-user request interference, and hard-to-reproduce path or header anomalies during HTTP/2 to HTTP/1.1 downgrade. The issue is not plain header injection; it is a message boundary disagreement between hops over Content-Length, Transfer-Encoding, pseudo-headers, and body framing.

How the skill works

The skill treats request smuggling as a boundary-framing investigation rather than a generic injection workflow:

• CL.TE / TE.CL / TE.TE: compares how the front hop and back hop interpret length headers, chunked encoding, and Transfer-Encoding obfuscation variants.
• HTTP/2 downgrade: examines :method, :path, duplicate headers, lowercase normalization, and handling of Connection-related headers when H1 requests are reconstructed.
• Client-side desync: evaluates browser Fetch, no-cors, CORS, and connection reuse effects that may create request or response queue misalignment.
• Tool-assisted verification: the material references tools such as Burp Suite — HTTP Request Smuggler, defparam/smuggler, and simple-http-smuggler-generator for generating probes, checking timing deltas, and assembling common variants.
• Detection routing: uses a decision-tree style to confirm whether the behavior is an HTTP message-boundary issue before moving to adjacent areas such as CRLF injection, Web Cache Deception, SSTI, or SQLi.

Scope and cautions

This skill is useful for security engineers, SREs, and backend developers who suspect a front-end plus origin two-hop mismatch. It is best used for triage, reproduction, log comparison, and minimal probing, not for uncontrolled fuzzing in production. Validate the topology first, keep concurrency low, avoid affecting other users, and focus on parser disagreement, connection reuse, and cache-key or response-queue anomalies.