request-smuggling

A rapid HTTP downgrade smuggling scanner written in Go.

Http request smuggling vulnerability scanner

A curated list of awesome blogs and tools about HTTP request smuggling attacks. Feel free to contribute! 🍻

HTTP request smuggling attack helper/CLI tools to manipulate HTTP packets

Blog about HTTP Request Smuggling, including a demo application.

Automated Discovery of Parsing Discrepancy Related Bypasses in Web Application Firewalls Using HTTP Request Fuzzing.

Burp extension to calculate the byte size of selections made in text windows

Compliance evidence for HTTP header security. Assesses both sides of the exchange — the request headers an attacker manipulates and the response headers you must send — confirms every finding with a second probe, maps it to OWASP ASVS 5.0 and PCI DSS 4.0.1, and reports what it could not assess instead of counting it as a pass.

HTTP Request Smuggling & Client-Side Desync framework for Exchange OWA. CL.TE/TE.CL detection, email spoofing, cache poisoning.

Lab didático de HTTP Request Smuggling (TE.CL) — servidor vulnerável em C + exploits Python

Detect and confirm HTTP/S desync vulnerabilities

Phage: an evolutionary HTTP/3-to-HTTP/1 request-smuggling desync fuzzer. A fork of CyberArk QuicDrawH3 that adds a MAP-Elites engine, QUIC-state genes (bare FIN, RESET), and H3/H2 downgrade operators on top of the Quic-Fin-Sync primitive.

automatic HTTP request smuggling vulnerability detection

8-phase cache & transport attack scanner — cache poison, request smuggling, H2C, CDN bypass

Байт-точный пробер HTTP request smuggling / desync на сырых сокетах. C++17, POSIX, ноль зависимостей. Authorized-only.

Bun-native conformance test library — built-in rules probe your running server with real bytes and judge it against international standards and security requirements, from inside your test runner.

HTTP Garden – outil de fuzzing différentiel pour détecter les divergences entre serveurs HTTP (adapté Windows)