http-request-smuggling

HTTP Request Smuggling Detection Tool

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability.

Analyze HTTP requests to minimize risks of HTTP Desync attacks (precursor for HTTP request smuggling/splitting).

Rust-powered HTTP Request Smuggling Scanner.

HTTP request smuggling attack helper/CLI tools to manipulate HTTP packets

HTTP3ONSTEROIDS - A research on CVE-2023-25950 where HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name.

HTTP request smuggling examples

HTTP Request Smuggling Payload List

Golang HTTP echo server (real raw request echoed)

CLTEcho is an advanced HTTP Request Smuggling detection suite featuring AI-powered analysis, concurrent scanning, and comprehensive reporting. With 6 threat detection types, ML-based anomaly detection, HTTP/2 support, and WAF bypass techniques, it delivers enterprise-grade security testing with professional HTML/JSON reports for security researcher

Notes from TryHackMe's Web Application Pentesting path. Goes beyond OWASP Top 10 basics into JWT and OAuth attacks, NoSQL/XXE/SSTI/LDAP injection, SSRF, insecure deserialization, and HTTP request smuggling across HTTP/1.1, HTTP/2, and WebSockets, with full kill chain writeups for each module's challenge room.

Web reconnaissance & cache-deception attack-chain tooling for authorized CTF / lab testing

Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3

Burp Suite Pro extension (Montoya API): HTTP request-smuggling / desync hypothesis scanner with a framing-aware, oracle-free classifier and Burp Collaborator OOB (SSRF) detection.

Personal TryHackMe write-ups, notes and methodologies covering web application penetration testing, vulnerability discovery, exploitation and remediation.

CVE-2026-59903 / CVE-2026-33870: offline checker for the 14 io.netty:netty-codec-http CVEs. Netty ships all modules under one version number but each has its own fix version — 4.1.136.Final (the netty-codec-http2 answer) still leaves this module exposed; it needs 4.1.137.Final / 4.2.17.Final.

CVE-2026-24880: does Apache's upgrade advice actually apply to your Tomcat? Detects the fix by class presence, not version comparison. Covers 7.0/8.0/8.5/9.0/10.0/10.1/11.0 lines.