Claude MarketplacesSubmit
yaklang avatar

Request Smuggling

yaklang/hack-skills

This is the playbook you reach for when you suspect a CDN, load balancer, or reverse proxy disagrees with the origin server about where one HTTP request ends and the next begins. It covers the classic CL.TE and TE.CL variants, TE.TE obfuscation techniques using malformed Transfer-Encoding headers, HTTP/2 downgrade attacks, and client-side desync via browser fetch pipelines. The examples are raw and specific, showing exact byte counts and CRLF placement for probe requests. This isn't header injection. It's exploiting message boundary disagreement to smuggle a second request inside the first, which can bypass WAFs, poison connection pools, or hijack other users' requests on shared backend connections. Use it in authorized scope only, ideally in isolated environments, because successful smuggling affects concurrent traffic.

skills.sh installs
3.8K
GitHub stars
2.6K
last updated
Aug 21, 2026
View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill request-smuggling --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: HTTP Request Smuggling — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert HTTP desync techniques. Covers CL.TE, TE.CL, TE.TE obfuscation variants, HTTP/2 downgrade and pseudo-header confusion, client-side desync (browser fetch pipelines), and tool-assisted fuzzing. Assumes familiarity with raw HTTP/1.1 framing and reverse-proxy topologies. This is not “header injection” — it is message boundary disagreement between hops.

Routing note: load this skill when you suspect CDN/reverse-proxy and origin disagree on request-end boundaries, or when abnormal concatenation appears during H2-to-H1 downgrade.

0. RELATED ROUTING

  • ghost-bits-cast-attack when the HTTP client library is Apache HttpClient <= 4.5.9 (HTTPCLIENT-1974/1978) — injecting 瘍瘊 (U+760D U+760A, low bytes \r\n) into a header value causes the underlying char-to-byte writer to emit a literal CRLF, splitting the request at the origin without relying on CL/TE disagreement

1. QUICK START

CL.TE first probe (front-end trusts CL, back-end trusts chunked)

SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Details

Repository
github.com/yaklang/hack-skills
Categories
Testing & QA, Automation & Workflows
First seen
May 16, 2026

More from yaklang/hack-skills

All 102

Recommended

More Testing & QA
1yaklang avatarfile-access-vulnyaklang/hack-skillsEntry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipe3.8Kskills.sh installs
2yaklang avatarinsecure-source-code-managementyaklang/hack-skillsSource control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authori3.8Kskills.sh installs
3giuseppe-trisciuoglio avataraws-sdk-java-v2-coregiuseppe-trisciuoglio/developer-kitProvides AWS SDK for Java 2.x client configuration, credential resolution, HTTP client tuning, timeout, retry, and testing patterns. Use when creating or harden3.8Kskills.sh installs
4forcedotcom avatardeveloping-agentforceforcedotcom/sf-skillsBuild, modify, debug, and deploy agents with Agentforce Agent Script. TRIGGER when: user creates, modifies, or asks about .agent files or aiAuthoringBundle meta3.8Kskills.sh installs
5yaklang avatarclickjackingyaklang/hack-skillsClickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether 3.8Kskills.sh installs
6hashicorp avatarrun-acceptance-testshashicorp/agent-skillsGuide for running acceptance tests for a Terraform provider. Use this when asked to run an acceptance test or to run a test with the prefix `TestAcc`.3.8Kskills.sh installs