A rapid HTTP downgrade smuggling scanner written in Go.
go golang http2 infosec pentesting vulnerability-scanners pentest-tool http-2 request-smuggling bounty-hunting-tools
-
Updated
May 16, 2024 - Go
#
request-smuggling
Here are 23 public repositories matching this topic...
Language: All
Filter by language
Sort: Most stars
Sort options
A curated list of awesome blogs and tools about HTTP request smuggling attacks. Feel free to contribute! 🍻
http security awesome awesome-list bugbounty http-smuggling request-smuggling requestsmuggling http-desync-attacks
-
Updated
Sep 6, 2022
HTTP request smuggling attack helper/CLI tools to manipulate HTTP packets
cli learning security http-client bug-bounty infosec burp websecurity pentest-tool http-request-smuggling request-smuggling
-
Updated
Sep 23, 2022 - Go
Blog about HTTP Request Smuggling, including a demo application.
-
Updated
Jan 4, 2022 - Python
Automated Discovery of Parsing Discrepancy Related Bypasses in Web Application Firewalls Using HTTP Request Fuzzing.
http firewall waf xss owasp fuzzing sql-injection bypass owasp-top-10 cross-site-scripting web-attacks request-smuggling
-
Updated
Jun 18, 2026 - Python
A lab-driven course on breaking web applications and explaining how to fix them — 491 notes, 36 reproducible labs, mapped to OWASP WSTG and the PortSwigger Top 10 Web Hacking Techniques.
oauth jwt xss owasp penetration-testing sql-injection csrf application-security web-security knowledge-base obsidian study-notes offensive-security ethical-hacking ssrf owasp-top-10 request-smuggling burp-suite wstg bscp
-
Updated
Aug 30, 2026
Burp extension to calculate the byte size of selections made in text windows
-
Updated
Sep 30, 2020 - Java
Compliance evidence for HTTP header security. Assesses both sides of the exchange — the request headers an attacker manipulates and the response headers you must send — confirms every finding with a second probe, maps it to OWASP ASVS 5.0 and PCI DSS 4.0.1, and reports what it could not assess instead of counting it as a pass.
http security pci-dss bug-bounty web-security pentesting compliance appsec security-scanner ssrf devsecops vulnerability-scanner http-headers request-smuggling host-header-injection cache-poisoning owasp-asvs
-
Updated
Aug 5, 2026 - Python
An HTTP/1.1 parser with a hard memory ceiling: 2352 bytes per request, 48-byte deepest stack frame, zero heap allocations - each enforced by the build rather than promised in prose.
-
Updated
Aug 22, 2026 - C
Burp Suite Pro extension (Montoya API): HTTP request-smuggling / desync hypothesis scanner with a framing-aware, oracle-free classifier and Burp Collaborator OOB (SSRF) detection.
java security pentesting burp appsec ssrf burp-plugin desync http-request-smuggling request-smuggling burp-suite http-desync montoya-api burp-extension montoya
-
Updated
Aug 13, 2026 - Java
-
Updated
Aug 4, 2026 - Rust
Detect and confirm HTTP/S desync vulnerabilities
-
Updated
Dec 31, 2019 - JavaScript
HTTP Request Smuggling & Client-Side Desync framework for Exchange OWA. CL.TE/TE.CL detection, email spoofing, cache poisoning.
-
Updated
Jun 29, 2026 - Python
Lab didático de HTTP Request Smuggling (TE.CL) — servidor vulnerável em C + exploits Python
-
Updated
May 14, 2026 - C
Phage: an evolutionary HTTP/3-to-HTTP/1 request-smuggling desync fuzzer. A fork of CyberArk QuicDrawH3 that adds a MAP-Elites engine, QUIC-state genes (bare FIN, RESET), and H3/H2 downgrade operators on top of the Quic-Fin-Sync primitive.
-
Updated
Sep 6, 2026 - Python
8-phase cache & transport attack scanner — cache poison, request smuggling, H2C, CDN bypass
-
Updated
Apr 24, 2026 - Shell
automatic HTTP request smuggling vulnerability detection
http exploit vulnerability-detection vulnerability-scanners burpsuite burp-extensions http-smuggling request-smuggling
-
Updated
May 30, 2020 - Python
Байт-точный пробер HTTP request smuggling / desync на сырых сокетах. C++17, POSIX, ноль зависимостей. Authorized-only.
-
Updated
Aug 10, 2026 - C++
CVE-2026-24880: does Apache's upgrade advice actually apply to your Tomcat? Detects the fix by class presence, not version comparison. Covers 7.0/8.0/8.5/9.0/10.0/10.1/11.0 lines.
java security tomcat cve eol sca apache-tomcat vulnerability-scanner tomcat7 tomcat9 dependency-check tomcat-security http-request-smuggling request-smuggling chunked-encoding patch-verification cwe-444 tomcat85 cve-2026-24880 ghsa-563x-q5rq-57qp
-
Updated
Sep 1, 2026 - Java
Add this topic to your repo
To associate your repository with the request-smuggling topic, visit your repo's landing page and select "manage topics."