Vulnerabilities
Find CL.TE and TE.CL desync on live hosts
Timing-based CL.TE and TE.CL desync detection for a URL or URL list.
overview
What http-request-smuggling does
HTTP request smuggling appears when a front-end proxy and a back-end disagree about where one request ends, usually because they parse Content-Length and Transfer-Encoding differently. An attacker can slip a hidden request past the proxy, poison the response queue, or bypass front-end controls.
This tool automates detection. It sends CL.TE and TE.CL desync payloads and watches response timing: a back-end that stalls waiting for smuggled bytes reveals the mismatch. Set --method, --timeout, and --retry so findings reflect repeatable delays, not one flaky response.
Trickest runs it as a managed vulnerabilities step that accepts -u or a --urls file and writes a results folder. Run after httpx so only live hosts are tested. Treat every hit as a candidate for manual confirmation in an intercepting proxy.
use cases
Where http-request-smuggling fits
Scan a host list for desync
Pass a URLs file so the tool probes every live host for request smuggling in one run instead of testing each by hand.
Confirm a single suspect target
Point it at one URL with -u and raise --retry to separate a real desync from a flaky response before you escalate.
Tune the test for slow back-ends
Adjust --timeout and --method so the check stays reliable against proxies that buffer, rate-limit, or reject POST.
Gate testing on live hosts
Run it after httpx so smuggling probes only hit hosts that responded, keeping the run focused and quieter.
reference
http-request-smuggling inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| single-url | STRING | -u | Single target URL to test, e.g. https://target.com. |
| urls-file | FILE | --urls | File listing target URLs to test, one per line. |
| http-method | STRING | --method | HTTP method to use, GET or POST (default POST). |
| timeout | STRING | --timeout | Socket timeout in seconds (default 10). |
| retry-payload | STRING | --retry | Retry count to re-execute the payload (default 2). |
Showing key inputs. http-request-smuggling exposes 5 inputs in total.
example
Run http-request-smuggling
# probe a single host for HTTP request smugglinghrs -u https://example.com --method POST --retry 3 --timeout 15[*] http-request-smuggling detection started[*] Target: https://example.com method=POST timeout=15 retry=3[CL.TE] payload sent, waiting on socket... response time 9.84s[CL.TE] VULNERABLE (back-end blocked on the smuggled request)[TE.CL] payload sent, waiting on socket... response time 0.31s[TE.CL] not vulnerable[*] 1 target tested, 1 flagged for review[*] results written to output/guidance
Choosing http-request-smuggling
Use this for a focused HTTP request smuggling check across live hosts. For broad templated coverage that includes some smuggling checks, nuclei is wider. For deep manual desync research, take its candidates into a hands-on proxy.
nuclei
Template scanner with some smuggling checks among thousands. Broader, less specialized for desync.
httpx
Probes which hosts are live. Run it first so smuggling tests only hit responding targets.
smuggler
Another dedicated desync detector. Cross-check results to confirm a smuggling finding across tools.
faq
http-request-smuggling questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run http-request-smuggling yourself
A URL list is probed by httpx, then http-request-smuggling tests the live hosts for desync and writes the candidate findings as a queryable output.
Facts on this page come from the live Trickest tool library.