HTTP request smuggling scanner that detects and tests for CL.TE, TE.CL, and TE.TE smuggling vulnerabilities in web servers and proxies.
smuggler {flag-no-color} {flag-methods} {flag-timeout} -u {url} 📎 flag-no-color 📎 flag-methods 📎 flag-timeout 📎 url smuggler {flag-no-color} {flag-methods} {flag-timeout} -u {url}Sandbox: execFile · Timeout: 120s
web.smuggle.detect web.smuggle.cl-te web.smuggle.te-cl web.smuggle.te-te | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
url | string | Yes | - | Target URL | -u, --url |
flag-no-color | boolean | No | - | Disable colored output | --no-color |
flag-timeout | integer | No | - | Request timeout in seconds | --timeout |
flag-methods | boolean | No | - | Check HTTP method-based smuggling | --methods |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
web.smuggling.report | Request smuggling scan results | text/plain | - | verified |
Inputs
web.target.url Target web server URL
Outputs
web.smuggling.report Scan results with detected smuggling vectors
network_traffic Produces
web.smuggling.reportConsumes
web.target.url| Resource | Value |
|---|---|
| CPU | low |
| Memory | 64 MB |
| Network | low |
| Disk I/O | low |
Basic smuggling scan
smuggler -u https://example.comScan with extended timeout
smuggler -u https://example.com --timeout 10Check method-based smuggling
smuggler -u https://example.com --methodsSmuggler is a Python-based tool for detecting HTTP request smuggling vulnerabilities. It tests for CL.TE (Content-Length / Transfer-Encoding), TE.CL (Transfer-Encoding / Content-Length), and TE.TE (Transfer-Encoding with obfuscation) variants.
# Basic scan
smuggler -u https://example.com
# Disable colors
smuggler -u https://example.com --no-color
# Check method-based smuggling
smuggler -u https://example.com --methods
# Custom timeout
smuggler -u https://example.com --timeout 10