loading
Loading content
loading
Vulnerabilities
Timing-based CL.TE and TE.CL desync detection for a URL or URL list.
overview
HTTP request smuggling appears when a front-end proxy and a back-end disagree about where one request ends, usually because they parse Content-Length and Transfer-Encoding differently. An attacker can slip a hidden request past the proxy, poison the response queue, or bypass front-end controls.
This tool automates detection. It sends CL.TE and TE.CL desync payloads and watches response timing: a back-end that stalls waiting for smuggled bytes reveals the mismatch. Set --method, --timeout, and --retry so findings reflect repeatable delays, not one flaky response.
Trickest runs it as a managed vulnerabilities step that accepts -u or a --urls file and writes a results folder. Run after httpx so only live hosts are tested. Treat every hit as a candidate for manual confirmation in an intercepting proxy.
use cases
Pass a URLs file so the tool probes every live host for request smuggling in one run instead of testing each by hand.
Point it at one URL with -u and raise --retry to separate a real desync from a flaky response before you escalate.
Adjust --timeout and --method so the check stays reliable against proxies that buffer, rate-limit, or reject POST.
Run it after httpx so smuggling probes only hit hosts that responded, keeping the run focused and quieter.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| single-url | STRING | -u | Single target URL to test, e.g. https://target.com. |
| urls-file | FILE | --urls | File listing target URLs to test, one per line. |
| http-method | STRING | --method | HTTP method to use, GET or POST (default POST). |
| timeout | STRING | --timeout | Socket timeout in seconds (default 10). |
| retry-payload | STRING | --retry | Retry count to re-execute the payload (default 2). |
Showing key inputs. http-request-smuggling exposes 5 inputs in total.
example
# probe a single host for HTTP request smugglinghrs -u https://example.com --method POST --retry 3 --timeout 15[*] http-request-smuggling detection started[*] Target: https://example.com method=POST timeout=15 retry=3[CL.TE] payload sent, waiting on socket... response time 9.84s[CL.TE] VULNERABLE (back-end blocked on the smuggled request)[TE.CL] payload sent, waiting on socket... response time 0.31s[TE.CL] not vulnerable[*] 1 target tested, 1 flagged for review[*] results written to output/guidance
Use this for a focused HTTP request smuggling check across live hosts. For broad templated coverage that includes some smuggling checks, nuclei is wider. For deep manual desync research, take its candidates into a hands-on proxy.
Template scanner with some smuggling checks among thousands. Broader, less specialized for desync.
Probes which hosts are live. Run it first so smuggling tests only hit responding targets.
Another dedicated desync detector. Cross-check results to confirm a smuggling finding across tools.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A URL list is probed by httpx, then http-request-smuggling tests the live hosts for desync and writes the candidate findings as a queryable output.
Facts on this page come from the live Trickest tool library.