loading
Loading content
loading
Vulnerabilities
HTTP request smuggling and desync tester for a single endpoint.
overview
smuggler probes one URL (-u) for HTTP request smuggling, where a front-end and back-end disagree on request boundaries via crafted Content-Length and Transfer-Encoding combinations.
Choose --method (default POST), optional --vhost for name-based hosts, and --configfile when you need custom mutations for a specific proxy stack.
Use --quiet to log only confirmed issues and --exit_early when a wide sweep only needs a yes or no. It is a focused desync check, not a broad scanner.
source github.com/defparam/smuggler
use cases
Probe a URL with crafted Content-Length and Transfer-Encoding combinations to detect front-end and back-end disagreement about request boundaries.
Enable quiet mode so the output logs only smuggling findings and keeps noise out of an automated pipeline.
Use exit-early when you only need to know whether a host is vulnerable, not the full payload matrix, across many targets.
Supply a config file of payloads to test mutations specific to a target's proxy stack beyond the built-in set.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Target URL with Endpoint |
| method | STRING | --method | HTTP method to use (e.g GET, POST) Default: POST |
| vhost | STRING | --vhost | Specify a virtual host |
| configfile | FILE | --configfile | Filepath to the configuration file of payloads |
| quiet | BOOLEAN | --quiet | Quiet mode will only log issues found |
| exit-early | BOOLEAN | --exit_early | Exit scan on first finding |
| no-color | BOOLEAN | --no-color | Suppress color codes |
Showing key inputs. smuggler exposes 7 inputs in total.
example
# probe a target for CL.TE / TE.CL desync, stop on first hitsmuggler.py -u https://example.com/api --method POST --quiet --exit_earlysmuggler v1.1 | target: https://example.com/api[+] TE.CL : Potential HTTP Request Smuggling └─ Transfer-Encoding: chunked + Content-Length mismatch[+] CL.TE : Timing anomaly vs baseline (delay ~3.1s)[-] H2.CL : no differential[-] H2.TE : no differential[*] Findings written to smuggler_out/[*] Exit early after first confirmed issueguidance
Use smuggler to test specific live endpoints for HTTP request smuggling and desync. Pair it with broader scanners for other vulnerability classes; run after probing, not as the first pass.
Looks for exposed files and misconfigurations rather than desync. A different web bug class.
Recovers IIS short filenames. Another targeted server-side check, not request smuggling.
Finds hijackable broken social links by crawling. Unrelated bug class on the same surface.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A target URL feeds smuggler, which probes it for request-smuggling desync and writes confirmed findings as a queryable output.
Facts on this page come from the live Trickest tool library.