hunt-http-smuggling

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-http-smuggling/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with real payloads, commands, and a current target-suitability matrix. Its weaknesses are a missing inline validation checkpoint (the exploitability criterion is deferred to a sibling skill) and a version-locked matrix that should be split out or marked as time-sensitive.

Suggestions

Pull the smuggling-confirm validation criterion inline as an explicit checkpoint: "Confirm the timing delta lands on a different client/session, not your own follow-up — else it is parser disagreement, not exploitable smuggling."

Move the version-locked target-suitability matrix into a referenced file (e.g. references/target-matrix.md) or label it as a periodically-refreshed "current deployment reality" section so the time-sensitive detail doesn't bloat the core skill.

Add a short Validate/feedback-loop subsection after the Detection steps so an operator re-runs the probe and confirms before escalating to an impact chain.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with no concept-padding, but the version-locked "2026 reality check" matrix and the repeated chain-primitive paragraphs across Related Skills are content that could be tightened; the rubric penalizes time-sensitive version detail outside a deprecated section.	2 / 3
Actionability	Provides concrete executable commands ("curl -sI https://target/ \| grep -i \"Server:\""), a real CL.TE payload, and specific tool sequences ("Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe") that are copy-paste ready.	3 / 3
Workflow Clarity	Steps are sequenced (fingerprint front-end → pick variant → probe → confirm timing), but the critical confirm-on-a-DIFFERENT-client validation checkpoint is only described in the cross-referenced triage-validation skill, not inline; missing inline validation for a risky operation caps the score at 2.	2 / 3
Progressive Disclosure	Sibling-skill references are one-level-deep and clearly signaled, but no bundle files exist in references/scripts/assets and the large inline target-suitability matrix is content that could appropriately live in a separate file.	2 / 3
	Total	9 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, third-person description that comprehensively covers the what and when with concrete variant taxonomy, tools, and an explicit Use-when trigger. Its main weakness is trigger-term quality: it leans on technical jargon that a non-specialist user would not naturally say.

Suggestions

Add a few natural-language trigger variants (e.g. "request desync", "CL.TE desync", "proxy parsing mismatch") so the description fires for users who don't use the H2.CL/TE.TE shorthand.

Trim the embedded validation-chain detail (cache poisoning, credential theft, auth bypass) from the description — that payoff detail belongs in the body, not the trigger.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions across the smuggling taxonomy — "CL.TE, TE.CL, H2.CL, H2.TE" variants plus detection ("Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler"), confirmation ("time-delay technique"), and validation chains (cache poisoning, credential theft, auth bypass).	3 / 3
Completeness	Explicitly answers both what (cause + variants + detection + confirm + validate) and when ("Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass").	3 / 3
Trigger Term Quality	Includes natural hunting terms ("HTTP request smuggling", "CDN+origin stacks", "load balancer / WAF bypass") but is jargon-heavy with variant codes (H2.CL, TE.TE) and misses common lay variations, narrowing the trigger audience.	2 / 3
Distinctiveness Conflict Risk	The smuggling-specific niche and explicit front-end/back-end parsing framing make it clearly distinct from sibling hunt-* skills and unlikely to trigger for the wrong skill.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-http-smuggling/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.