Request Smuggling

This is the playbook you reach for when you suspect a CDN, load balancer, or reverse proxy disagrees with the origin server about where one HTTP request ends and the next begins. It covers the classic CL.TE and TE.CL variants, TE.TE obfuscation techniques using malformed Transfer-Encoding headers, HTTP/2 downgrade attacks, and client-side desync via browser fetch pipelines. The examples are raw and specific, showing exact byte counts and CRLF placement for probe requests. This isn't header injection. It's exploiting message boundary disagreement to smuggle a second request inside the first, which can bypass WAFs, poison connection pools, or hijack other users' requests on shared backend connections. Use it in authorized scope only, ideally in isolated environments, because successful smuggling affects concurrent traffic.

Install to Claude Code

npx -y skills add yaklang/hack-skills --skill request-smuggling --agent claude-code