Smuggler

Smuggler is an HTTP request smuggling / desync testing tool written in Python. It tests for vulnerabilities where a front-end server and back-end server disagree on how to parse HTTP requests, specifically around Content-Length and Transfer-Encoding header handling. This disagreement can allow an attacker to 'smuggle' a second request inside the first, potentially bypassing security controls, poisoning web caches, hijacking other users' requests, or accessing internal endpoints. Smuggler tests for CL.TE (Content-Length / Transfer-Encoding), TE.CL (Transfer-Encoding / Content-Length), and TE.TE (Transfer-Encoding / Transfer-Encoding with obfuscation) variants. It sends carefully crafted requests and analyzes timing differences and response behavior to detect desync conditions. The tool is essential for testing modern web architectures that use reverse proxies, CDNs, and load balancers.