Checks
smugglex supports 7 types of HTTP Request Smuggling checks. Each exploits differences in how front-end and back-end servers parse HTTP requests.
| Check | Description |
|---|---|
| CL.TE | Content-Length vs Transfer-Encoding |
| TE.CL | Transfer-Encoding vs Content-Length |
| TE.TE | Transfer-Encoding obfuscation (40+ variants) |
| H2C | HTTP/2 Cleartext smuggling |
| H2 | HTTP/2 protocol smuggling |
| CL-Edge | Content-Length edge cases |
h2-downgrade |
Real HTTP/2 (ALPN h2) H2.CL / H2.TE downgrade — HTTPS targets only |
Run Specific Checks
smugglex -c cl-te,te-cl https://target.com
Detection Method
smugglex uses timing-based detection. It measures baseline response times, then sends smuggling payloads and compares. A response is flagged only when it is both well past the baseline — at least 3× the median (or the slowest baseline + 500 ms, whichever is larger) — and over 1 second, which indicates desynchronization.