# PortSwigger/http-request-smuggler

Repository: https://github.com/PortSwigger/http-request-smuggler
Canonical: https://ross.abutalabs.com/products/http-request-smuggler
Homepage: https://portswigger.net/blog/http-desync-attacks
Language: Java
License: NOASSERTION
License Family: other
Topics: extension
Last push: 2026-08-13T10:42:16+00:00

## Health v2 (maintenance only)
Score: 76/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 97, release rhythm 35, longevity 100
- inputs: {"age_days": 2591, "days_push": 20, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1236, forks 129 (observed 2026-08-28T04:04:05.265614+00:00)

## What it is
A Burp Suite extension that automatically detects and exploits HTTP Request Smuggling vulnerabilities, including HTTP/1.1 CL.TE/TE.CL desyncs, HTTP/2-downgrade smuggling, client-side desyncs, and connection state attacks. It uses parser discrepancy detection to bypass desync defences and integrates with Turbo Intruder for automated exploit generation.

## Use cases
- detect http request smuggling vulnerabilities in a web target
- scan for http/2 downgrade desync issues
- test for client-side desync attacks in browsers
- find header smuggling and removal vulnerabilities
- generate automated smuggling exploits with turbo intruder
- bypass desync defences using parser discrepancy detection
- run recurring dast scans for request smuggling

## When to choose
- you are doing web application penetration testing or bug bounty hunting with Burp Suite
- you need reliable, research-grade detection of request smuggling including HTTP/2 and client-side desyncs
- you want automated exploit generation for confirmed desync vulnerabilities

## When to avoid
- you need a standalone CLI scanner outside of Burp Suite
- you are looking for a general-purpose web vulnerability scanner rather than a smuggling specialist
- your target stack cannot be safely tested with active desync probes

## Facets
- artifact type: plugin
- maturity: active
- function: penetration-testing, vulnerability-scanning, security, http-client
- domain: security, penetration-testing, web-development, developer-tools
- platform: jvm, cross-platform
- tags: burp-suite-extension, http-request-smuggling, desync, http2, web-security, vulnerability-scanner, turbo-intruder, desktop

## Member repositories
- PortSwigger/http-request-smuggler (main) score 76

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:05.265614+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T08:21:56.521378+00:00, confidence not recorded.
  - readme: https://github.com/PortSwigger/http-request-smuggler (fetched 2026-08-28T04:04:05.265614+00:00, sha 506dac2d20c2)
  - homepage: https://portswigger.net/blog/http-desync-attacks (fetched 2026-08-29T12:21:16.014559+00:00, sha 04c900c2f8f3)
  - site_page: https://portswigger.net/about (fetched 2026-08-29T12:21:16.024472+00:00, sha 169c41376de5)
  - site_page: https://portswigger.net/burp/documentation (fetched 2026-08-29T12:21:16.028313+00:00, sha 81bf81a32b5c)
  - site_page: https://portswigger.net/burp/documentation/desktop/getting-started (fetched 2026-08-29T12:21:16.029904+00:00, sha 65c8225eb7bb)
  - site_page: https://portswigger.net/burp/documentation/dast/setup (fetched 2026-08-29T12:21:16.032054+00:00, sha 61320640eca8)
  - site_page: https://portswigger.net/about/contact (fetched 2026-08-29T12:21:16.035566+00:00, sha 92c2df0aac75)
  - site_page: https://portswigger.net/support/reseller-faqs (fetched 2026-08-29T12:21:16.026473+00:00, sha 9ecd32d4698e)
  - site_page: https://portswigger.net/burp/releases (fetched 2026-08-29T12:21:16.033975+00:00, sha d83cfa415479)
- Data as of 2026-08-30T08:39:29.467469+00:00.