Skills for Real Engineers. Straight from my .agents directory.
39 skills
hunt-http-smuggling
Agent skill from
Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.
How to install hunt-http-smuggling
install hunt-http-smuggling
# install the Claude-BugHunter pack with the skills CLI
npx skills add elementalsouls/Claude-BugHunter# or add only this skill to Claude Code: copy the folder
skills/hunt-http-smuggling/
# into
~/.claude/skills/hunt-http-smuggling/ (all projects)
.claude/skills/hunt-http-smuggling/ (one project)
1## 17. HTTP REQUEST SMUGGLING2> Lowest dup rate. $5K–$30K. PortSwigger research by James Kettle.34### CL.TE (Content-Length front, Transfer-Encoding back)5```http6POST / HTTP/1.17Content-Length: 138Transfer-Encoding: chunked91001112SMUGGLED13```1415### Detection16```171. Burp extension: HTTP Request Smuggler182. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe193. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body20```2122### Impact Chain23```24Poison next request → access admin as victim25Steal credentials → capture victim's session26Cache poisoning → stored XSS at scale27```2829---3031## Target-Suitability Matrix (2026 reality check)3233The classic CL.TE / TE.CL payloads are NOT universally exploitable in 2026. Modern proxies are RFC 9112 strict by default. Fingerprint the front-end BEFORE investing time.3435| Front-end | CL.TE | TE.CL | H2.CL | H2.TE | Notes |36|---|---|---|---|---|---|37| **Nginx ≥ 1.21** | NO | NO | partial (H2 ingress) | partial | RFC-strict; rejects CL+TE with HTTP 400. Verified locally on Nginx 1.27 — all 9 documented variants killed by front-end ([docs/verification/phase2h-smuggling-cachepoison.md](../../docs/verification/phase2h-smuggling-cachepoison.md)). |38| **Caddy 2.x** | NO | NO | — | — | Hardened by default |39| **Envoy ≥ 1.20** | NO | NO | partial | partial | Hardened in most paths |40| **HAProxy ≤ 2.4** | ✓ | ✓ | — | — | **Vulnerable**, see CVE-2021-40346 |41…
Excerpt shown under the repository's MIT license.
More skills in Claude-BugHunter
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
Public repository for Agent Skills
20 skills
An AI skill that provides design intelligence for building professional UI/UX across multiple platforms.
CCCXCUGH6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills