Skip to content
Hugin capabilities

How to test for HTTP request smuggling

Request smuggling is a disagreement between two servers about where one request ends and the next begins. It is high-impact and easy to test for — if you know what to look for. This is the practical method, not the theory.

The method

  1. 1

    Understand the two parsers

    A front-end proxy and a back-end server both parse Content-Length and Transfer-Encoding. Smuggling exists when they disagree — one honours CL, the other TE, or one accepts an obfuscated TE the other rejects.

  2. 2

    Find the framing headers the endpoint accepts

    Send requests that vary Content-Length and Transfer-Encoding together (CL.TE, TE.CL) and watch for a timing anomaly or an unexpected 400. A differential response is your first signal.

  3. 3

    Probe TE obfuscation (TE.TE)

    If both servers process TE, try obfuscating the header so one server ignores it: unusual casing, extra whitespace, a duplicate header, or a line-wrap. Whichever server "drops" it becomes the smuggling vector.

  4. 4

    Test the HTTP/2 downgrade path (H2.TE)

    If the front-end speaks HTTP/2 and translates to HTTP/1.1 at the back-end, an injected Transfer-Encoding header is often preserved while Content-Length is rewritten. That is H2.TE smuggling.

  5. 5

    Prove impact with a request queue

    Once you have a desync, send a request that poisons the next user request and observe the reflected prefix. A reflected prefix you control is the proof; a timing difference alone is not.

  6. 6

    Check gRPC and gateway seams

    gRPC-gateway set-ups translate JSON to protobuf and back; the translation layer can desync differently from the raw proxy. Test it as a separate differential rather than assuming HTTP smuggling covers it.

Do it in Hugin

Hugin ships a first-class request-smuggling engine that probes CL.TE, TE.CL, TE.TE, H2.TE and gRPC-gateway differentials, then hands the working case to the Repeater to prove a reflected prefix — instead of wiring extensions together by hand.

Request smuggling engine capability

Frequently asked

Is request smuggling still common in 2026?

Yes. Any stack with a front-end proxy or CDN in front of a different origin server can desync. It is most common where HTTP/2 is terminated at the edge and HTTP/1.1 is used internally.

What is the difference between CL.TE and TE.CL?

In CL.TE the front-end uses Content-Length while the back-end uses Transfer-Encoding; in TE.CL it is the reverse. The smuggled request is hidden where the two servers disagree about the body boundary.

How do I prove request smuggling without harming other users?

Use a benign marker in the poisoned request and, where possible, test against an isolated environment or your own second account so the "next request" you affect is yours. Prove the prefix, not real-world impact on others.

Put the method into a tool

Hugin is free to download, no account.

Download Hugin

More guides