Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
Request Smuggling
When front-end and back-end proxies disagree on where a request ends, you can smuggle a second request past the front-end entirely. The disagreement is Content-Length vs Transfer-Encoding — the front-end trusts one, the back-end the other.
Severity guide
High — poisoning caches, hijacking requests, and bypassing front-end security controls are all proven impacts; detection alone is usually accepted on major programs.
Where to look
entry points to test first01
Any site behind a proxy chain
CDN → load balancer → app stacks (Cloudflare, AWS ALB, nginx fronting anything) are the hunting ground.
02
Admin panels behind the proxy
/admin blocked at the edge? Smuggling reaches it from inside the chain.
03
Cached responses
Poisoning shared caches affects every user of the poisoned path — the highest-impact variant.
04
Auth/session boundaries
Front-end-injected headers (X-Forwarded-For, trusted identity headers) can be overwritten from the smuggled request.
05
HTTP/2 → 1.1 downgrades
h2 frontend translating to HTTP/1.1 backend — the modern smuggling frontier (CL.0, 0.CL).
How to hunt it
in order, start to finishDetect the disagreement
Send a CL+TE ambiguity with a timed payload — a delayed response on the right combination proves the two layers disagree.
Try CL.TE then TE.CL
Content-Length first vs Transfer-Encoding first — each direction smuggles differently depending on which layer trusts which header.
Exploit TE.TE obfuscation
Duplicate/malformed Transfer-Encoding headers (tabs, spaces, xchunked) make one layer see TE and the other CL.
Smuggle a prefix
Append a partial GET /admin request — the next victim's request completes yours and returns the forbidden page.
Escalate to capture or poison
Smuggle a form that stores the next victim's headers (capture), or point a cacheable response at your payload (poison). Either is a full report.
Filter & validation bypasses
when your first tries get blocked- 01Both headers processed? Duplicate TE with different obfuscations — one layer normalizes, the other doesn't.
- 02CL.0 quirk: some backends ignore Content-Length on GET/HEAD — a CL-carrying GET smuggles past proxies that expect bodyless GETs.
- 03Detection blocked? Vary header casing, use obs-fold line continuations, or HTTP/2 pseudo-header injection.
- 04Timing noisy? Use differential detection — smuggle a probe and look for the connection-level errors instead.
Impact ladder
what makes it payable- 01Cache poisoning — serve attacker content to every visitor of a URL.
- 02Request hijacking — capture victims' headers/cookies on shared connections.
- 03Security-control bypass — reach edge-blocked paths from inside the chain.
- 04Auth-header injection — overwrite trusted forwarded headers to impersonate users.
Payloads
6 · from PayloadsAllTheThingsTransfer-Encoding: xchunkedObfuscated TE — one proxy sees an invalid TE and falls back to CL.
Transfer-Encoding : chunkedSpace before the colon — invalid to some parsers, valid TE to others.
Transfer-Encoding:[tab]chunkedTab-delimited variant for the same parser disagreement.
X: X[\n]Transfer-Encoding: chunkedHeader-smuggling variant — TE hidden mid-value.
header ignored\r\n\r\nGET / HTTP/1.1\r\nHost: www.example.comThe smuggled prefix — the next request on the connection completes it.
python3 smuggler.py -hsmuggler — automated CL.TE/TE.CL detection across many obfuscations.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.