A rapid HTTP downgrade smuggling scanner written in Go.
A curated list of awesome blogs and tools about HTTP request smuggling attacks. Feel free to contribute! 🍻
HTTP request smuggling attack helper/CLI tools to manipulate HTTP packets
Blog about HTTP Request Smuggling, including a demo application.
Automated Discovery of Parsing Discrepancy Related Bypasses in Web Application Firewalls Using HTTP Request Fuzzing.
Burp extension to calculate the byte size of selections made in text windows
Compliance evidence for HTTP header security. Assesses both sides of the exchange — the request headers an attacker manipulates and the response headers you must send — confirms every finding with a second probe, maps it to OWASP ASVS 5.0 and PCI DSS 4.0.1, and reports what it could not assess instead of counting it as a pass.
HTTP Request Smuggling & Client-Side Desync framework for Exchange OWA. CL.TE/TE.CL detection, email spoofing, cache poisoning.
Burp Suite Pro extension (Montoya API): HTTP request-smuggling / desync hypothesis scanner with a framing-aware, oracle-free classifier and Burp Collaborator OOB (SSRF) detection.
Detect and confirm HTTP/S desync vulnerabilities
An HTTP/1.1 parser with a hard memory ceiling: 2352 bytes per request, 48-byte deepest stack frame, zero heap allocations - each enforced by the build rather than promised in prose.
Lab didático de HTTP Request Smuggling (TE.CL) — servidor vulnerável em C + exploits Python
8-phase cache & transport attack scanner — cache poison, request smuggling, H2C, CDN bypass
automatic HTTP request smuggling vulnerability detection
Phage: an evolutionary HTTP/3-to-HTTP/1 request-smuggling desync fuzzer. A fork of CyberArk QuicDrawH3 that adds a MAP-Elites engine, QUIC-state genes (bare FIN, RESET), and H3/H2 downgrade operators on top of the Quic-Fin-Sync primitive.
Байт-точный пробер HTTP request smuggling / desync на сырых сокетах. C++17, POSIX, ноль зависимостей. Authorized-only.
Bun-native conformance test library — built-in rules probe your running server with real bytes and judge it against international standards and security requirements, from inside your test runner.
Refuses an HTTP header block that two conforming parsers would frame differently
Add a description, image, and links to the request-smuggling topic page so that developers can more easily learn about it.
To associate your repository with the request-smuggling topic, visit your repo's landing page and select "manage topics."