PortSwigger/http-request-smuggler

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1236 stars · 129 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Burp Suite extension that automatically detects and exploits HTTP Request Smuggling vulnerabilities, including HTTP/1.1 CL.TE/TE.CL desyncs, HTTP/2-downgrade smuggling, client-side desyncs, and connection state attacks. It uses parser discrepancy detection to bypass desync defences and integrates with Turbo Intruder for automated exploit generation.

Use cases

• detect http request smuggling vulnerabilities in a web target
• scan for http/2 downgrade desync issues
• test for client-side desync attacks in browsers
• find header smuggling and removal vulnerabilities
• generate automated smuggling exploits with turbo intruder
• bypass desync defences using parser discrepancy detection
• run recurring dast scans for request smuggling

When to choose

• you are doing web application penetration testing or bug bounty hunting with Burp Suite
• you need reliable, research-grade detection of request smuggling including HTTP/2 and client-side desyncs
• you want automated exploit generation for confirmed desync vulnerabilities

When to avoid

• you need a standalone CLI scanner outside of Burp Suite
• you are looking for a general-purpose web vulnerability scanner rather than a smuggling specialist
• your target stack cannot be safely tested with active desync probes

Facets

plugin · maturity active

penetration-testing vulnerability-scanning security http-client security penetration-testing web-development developer-tools jvm cross-platform burp-suite-extension http-request-smuggling desync http2 web-security vulnerability-scanner turbo-intruder desktop

Member repositories

For agents

markdown · JSON · MCP: product_card(name="PortSwigger/http-request-smuggler")