elementalsouls/Claude-BugHunter✦ 精选0°

hunt-http-smuggling

仓库创建 2026年5月5日最近提交 4 天前SkillHot 收录 20 天前

⬈ GitHub 仓库 ⬈ SKILL.md 原文件 ⬇ Raw 原始文件

▸ 精选理由

给出典型触发与检测方法，适合红队与安全研究

▸ 风险提示

含可用于构造攻击载荷的示例，存在滥用风险

这个 Skill 做什么

识别与利用 HTTP 请求走私（CL.TE/TE.CL 等）导致的漏洞

用于发现并利用 HTTP request smuggling（比如 CL.TE、TE.CL、H2.CL 等），当前端和后端对请求边界解析不一致时就能起作用。常用于实现缓存中毒、会话欺骗或绕过安全网关，检测手段有 Burp 的 Smuggler 插件、smuggler.py 和时间差探测法。能把伪造请求悄悄送到后端，形成对后续用户流量的持久影响。

▸ 展开 SKILL.md 英文原文

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.

研究检索HTTP走私代理差异请求分割通用

3.1k

Stars

480

Forks

仓库内 Skill

+245

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-http-smuggling/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-http-smuggling/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## 17. HTTP REQUEST SMUGGLING
> Lowest dup rate. $5K–$30K. PortSwigger research by James Kettle.

### CL.TE (Content-Length front, Transfer-Encoding back)
```http
POST / HTTP/1.1
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED
```

### Detection
```
1. Burp extension: HTTP Request Smuggler
2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe
3. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body
```

### Impact Chain
```
Poison next request → access admin as victim
Steal credentials → capture victim's session
Cache poisoning → stored XSS at scale
```

---

## Target-Suitability Matrix (2026 reality check)

The classic CL.TE / TE.CL pay

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有