Vulnerabilities
Probe a URL for request smuggling desync
HTTP request smuggling and desync tester for a single endpoint.
overview
What smuggler does
smuggler probes one URL (-u) for HTTP request smuggling, where a front-end and back-end disagree on request boundaries via crafted Content-Length and Transfer-Encoding combinations.
Choose --method (default POST), optional --vhost for name-based hosts, and --configfile when you need custom mutations for a specific proxy stack.
Use --quiet to log only confirmed issues and --exit_early when a wide sweep only needs a yes or no. It is a focused desync check, not a broad scanner.
source github.com/defparam/smuggler
use cases
Where smuggler fits
Test an endpoint for desync
Probe a URL with crafted Content-Length and Transfer-Encoding combinations to detect front-end and back-end disagreement about request boundaries.
Scan only for confirmed issues
Enable quiet mode so the output logs only smuggling findings and keeps noise out of an automated pipeline.
Stop on first finding
Use exit-early when you only need to know whether a host is vulnerable, not the full payload matrix, across many targets.
Drive custom payloads
Supply a config file of payloads to test mutations specific to a target's proxy stack beyond the built-in set.
reference
smuggler inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Target URL with Endpoint |
| method | STRING | --method | HTTP method to use (e.g GET, POST) Default: POST |
| vhost | STRING | --vhost | Specify a virtual host |
| configfile | FILE | --configfile | Filepath to the configuration file of payloads |
| quiet | BOOLEAN | --quiet | Quiet mode will only log issues found |
| exit-early | BOOLEAN | --exit_early | Exit scan on first finding |
| no-color | BOOLEAN | --no-color | Suppress color codes |
Showing key inputs. smuggler exposes 7 inputs in total.
example
Run smuggler
# probe a target for CL.TE / TE.CL desync, stop on first hitsmuggler.py -u https://example.com/api --method POST --quiet --exit_earlysmuggler v1.1 | target: https://example.com/api[+] TE.CL : Potential HTTP Request Smuggling └─ Transfer-Encoding: chunked + Content-Length mismatch[+] CL.TE : Timing anomaly vs baseline (delay ~3.1s)[-] H2.CL : no differential[-] H2.TE : no differential[*] Findings written to smuggler_out/[*] Exit early after first confirmed issueguidance
Choosing smuggler
Use smuggler to test specific live endpoints for HTTP request smuggling and desync. Pair it with broader scanners for other vulnerability classes; run after probing, not as the first pass.
snallygaster
Looks for exposed files and misconfigurations rather than desync. A different web bug class.
shortscan
Recovers IIS short filenames. Another targeted server-side check, not request smuggling.
socialhunter
Finds hijackable broken social links by crawling. Unrelated bug class on the same surface.
faq
smuggler questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run smuggler yourself
A target URL feeds smuggler, which probes it for request-smuggling desync and writes confirmed findings as a queryable output.
Facts on this page come from the live Trickest tool library.