Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Vulnerabilities

Find CL.TE and TE.CL desync on live hosts

Timing-based CL.TE and TE.CL desync detection for a URL or URL list.

Python · MIT license

Agent
Scan a host list for desyncConfirm a single suspect targetTune the test for slow back-ends

overview

What http-request-smuggling does

HTTP request smuggling appears when a front-end proxy and a back-end disagree about where one request ends, usually because they parse Content-Length and Transfer-Encoding differently. An attacker can slip a hidden request past the proxy, poison the response queue, or bypass front-end controls.

This tool automates detection. It sends CL.TE and TE.CL desync payloads and watches response timing: a back-end that stalls waiting for smuggled bytes reveals the mismatch. Set --method, --timeout, and --retry so findings reflect repeatable delays, not one flaky response.

Trickest runs it as a managed vulnerabilities step that accepts -u or a --urls file and writes a results folder. Run after httpx so only live hosts are tested. Treat every hit as a candidate for manual confirmation in an intercepting proxy.

source github.com/anshumanpattnaik/http-request-smuggling

use cases

Where http-request-smuggling fits

Scan a host list for desync

Pass a URLs file so the tool probes every live host for request smuggling in one run instead of testing each by hand.

Confirm a single suspect target

Point it at one URL with -u and raise --retry to separate a real desync from a flaky response before you escalate.

Tune the test for slow back-ends

Adjust --timeout and --method so the check stays reliable against proxies that buffer, rate-limit, or reject POST.

Gate testing on live hosts

Run it after httpx so smuggling probes only hit hosts that responded, keeping the run focused and quieter.

reference

http-request-smuggling inputs and flags

5 inputs
NameTypeFlagDescription
single-urlSTRING-uSingle target URL to test, e.g. https://target.com.
urls-fileFILE--urlsFile listing target URLs to test, one per line.
http-methodSTRING--methodHTTP method to use, GET or POST (default POST).
timeoutSTRING--timeoutSocket timeout in seconds (default 10).
retry-payloadSTRING--retryRetry count to re-execute the payload (default 2).

Showing key inputs. http-request-smuggling exposes 5 inputs in total.

example

Run http-request-smuggling

http-request-smuggling · command
# probe a single host for HTTP request smuggling
hrs -u https://example.com --method POST --retry 3 --timeout 15
sample output
[*] http-request-smuggling  detection started
[*] Target: https://example.com   method=POST timeout=15 retry=3
[CL.TE] payload sent, waiting on socket... response time 9.84s
[CL.TE] VULNERABLE  (back-end blocked on the smuggled request)
[TE.CL] payload sent, waiting on socket... response time 0.31s
[TE.CL] not vulnerable
[*] 1 target tested, 1 flagged for review
[*] results written to output/

guidance

Choosing http-request-smuggling

Use this for a focused HTTP request smuggling check across live hosts. For broad templated coverage that includes some smuggling checks, nuclei is wider. For deep manual desync research, take its candidates into a hands-on proxy.

nuclei

Template scanner with some smuggling checks among thousands. Broader, less specialized for desync.

httpx

Probes which hosts are live. Run it first so smuggling tests only hit responding targets.

smuggler

Another dedicated desync detector. Cross-check results to confirm a smuggling finding across tools.

faq

http-request-smuggling questions

It sends CL.TE and TE.CL desync payloads, requests where Content-Length and Transfer-Encoding conflict. Detection is timing-based: if the back-end stalls waiting for the smuggled bytes, the response is delayed and that technique is flagged.

Use -u for one host, or --urls with a file of URLs (one per line) to sweep a whole list. On Trickest, set the single-url or urls-file input instead of typing the flag.

The --retry flag re-executes each payload a set number of times (default 2), so a reported finding reflects repeatable desync behavior rather than one slow response. Raise it for noisy or rate-limited targets.

Yes. --method switches between GET and POST (default POST), and --timeout sets the socket timeout in seconds (default 10). Widen the timeout for slow back-ends so a real desync delay is not cut off early.

Yes. Treat the output as candidates and reproduce each desync in an intercepting proxy, since real-world impact depends on the specific front-end and back-end stack. Cross-check with a second detector such as smuggler when doubt remains.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run http-request-smuggling yourself

A URL list is probed by httpx, then http-request-smuggling tests the live hosts for desync and writes the candidate findings as a queryable output.

Run http-request-smuggling in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.