LogicalBreach Academy

HTTP Request Smuggling Cheat Sheet | LogicalBreach Academy

Writeups Cheatsheets Tools Collections Authors Noc Pricing

Back

HTTP Request Smuggling (CWE-444)

HTTP Request Smuggling Cheat Sheet

pyus3r

March 4, 2026

24 views

Save

Cheatsheet Summary

HTTP Request Smuggling is an interference vulnerability that occurs when a front-end server and a back-end server disagree on the boundaries of HTTP requests. By manipulating the Content-Length (CL) and Transfer-Encoding (TE) headers, or exploiting HTTP/2 downgrades, an attacker can smuggle hidden requests.

🕵️ HTTP Request Smuggling Cheat Sheet

🔍 1. Discovery & Identification

To identify Request Smuggling, we must observe how the front-end and back-end handle ambiguous requests using either the Content-Length (CL) or Transfer-Encoding (TE) headers.

💡 Tip: Always use tools like Burp Suite's "HTTP Request Smuggler" extension to automate discovery. Check for CL.TE first to avoid poisoning the socket for other users.