Generic HTTP Request Smuggling Vulnerability Scanner

Sample Attack Scenario For HTTP Request Smuggling

Consider a reverse proxy server (e.g., Nginx) sitting in front of an application server (e.g., Apache or Node.js) that hosts a web application.

If these two servers parse HTTP requests differently — for instance, one honors the Content-Length header while the other follows Transfer-Encoding: chunked — an attacker can smuggle a request past the front-end system.

Here's a simplified example of how an attacker may exploit this:

POST / HTTP/1.1
Host: vulnerable-site.com
Content-Length: 4
Transfer-Encoding: chunked

0

G

This payload is crafted so the front-end interprets it as a single request with no body (due to Content-Length), while the backend sees a chunked transfer with an additional malicious payload. This misalignment allows the attacker to inject a hidden request that bypasses authentication or interacts with other users' sessions.

Impacts of HTTP Request Smuggling include:

• Bypassing authentication and accessing protected resources
• Stealing session tokens from other users
• Poisoning web caches to serve malicious content
• Triggering unexpected backend behavior
• Launching internal scanning or service interaction