hunt-http-smuggling

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is dense, actionable, and well-sectioned with concrete payloads and a useful 2026 target matrix. Its weakest point is workflow clarity: the detection/confirm/validate flow is scattered rather than a single explicit checkpointed sequence for a probe class that risks hitting live victims.

Suggestions

Add one explicit numbered workflow (fingerprint front-end → select vector → send probe → confirm via time-delay → validate impact on a separate victim session) with validation checkpoints, rather than scattering detection/confirm/validate across sections.

Show concrete TE.CL and H2.CL/H2.TE probe payloads alongside the CL.TE example so all four advertised variants have copy-paste-ready guidance.

Trim the verbose 'Chain primitive:' descriptions in Related Skills & Chains to one line each, or move them into a separate references file.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with concrete payload blocks and a tight target-suitability table, but the 'Related Skills & Chains' section and the 'collector gadget' prose repeat impact descriptions that could be trimmed.	4 / 5
Actionability	Provides an executable CL.TE payload, a fingerprint curl one-liner, and named tools (Burp Smuggler, smuggler.py, h2csmuggler), but only one of the four variant payloads is actually shown — a minor coverage gap.	4 / 5
Workflow Clarity	Detection steps and a confirm concept exist, but they are not presented as a crisp numbered sequence with explicit validation checkpoints, and smuggling probes that affect live victims lack a clearly sequenced validate→fix→retry feedback loop.	3 / 5
Progressive Disclosure	Well-organized with clear section headers and no bundle files to manage, though one reference points outside the skill bundle ('../../docs/verification/...') and the lengthy chains section is inlined rather than split out.	4 / 5
	Total	15 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely names capabilities, tools, and trigger conditions with an explicit 'Use when' clause. Only minor overlap risk with sibling hunting skills keeps it just short of a perfect mark.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across all four variants ('CL.TE, TE.CL, H2.CL, H2.TE') plus detection tools, a confirm technique ('time-delay technique'), and three validate chains (cache poisoning, credential theft, auth bypass) — comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what ('Hunt HTTP request smuggling... Confirm... Validate...') and when ('Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass').	5 / 5
Trigger Term Quality	Includes natural phrases a user would actually say — 'HTTP request smuggling', 'WAF bypass', 'load balancer', 'CDN+origin stacks' — alongside the technical CL.TE/TE.CL synonyms and tool names.	5 / 5
Distinctiveness Conflict Risk	The smuggling niche has distinct triggers, but the description explicitly shares impact chains with sibling skills (cache poisoning, auth bypass, IDOR), creating minor overlap risk with closely related hunt-* skills.	4 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 suspicious	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-http-smuggling/SKILL.md
Commit: 646b72e

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.