# Request Smuggler | HTTP Request Smuggling Vulnerability Scanner

**URL:** <https://onehack.st/t/request-smuggler-http-request-smuggling-vulnerability-scanner/222221>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, hosting\
**Created:** [August 9, 2022, 9:05pm UTC](https://onehack.st/t/request-smuggler-http-request-smuggling-vulnerability-scanner/222221 "2022-08-09T21:05:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [August 9, 2022, 9:05pm UTC](https://onehack.st/t/request-smuggler-http-request-smuggling-vulnerability-scanner/222221/1 "2022-08-09T21:05:40Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/c/e/ce25c093aa99f074f6d0390eb9842de7577b8761.png)

[![crates.io](https://camo.githubusercontent.com/8b28a4fa21bee1d74cb7550457549cee5587d85d790590d8317b9b43c9762581/68747470733a2f2f696d672e736869656c64732e696f2f6372617465732f762f726571756573745f736d7567676c65722e737667)](https://camo.githubusercontent.com/8b28a4fa21bee1d74cb7550457549cee5587d85d790590d8317b9b43c9762581/68747470733a2f2f696d672e736869656c64732e696f2f6372617465732f762f726571756573745f736d7567676c65722e737667) [![stars](https://camo.githubusercontent.com/ff2757c49537892d2a7f17f8a7ca629fa9d7d8a3a0197f5cd214189b435cbc2f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f536831596f2f726571756573745f736d7567676c6572)](https://camo.githubusercontent.com/ff2757c49537892d2a7f17f8a7ca629fa9d7d8a3a0197f5cd214189b435cbc2f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f536831596f2f726571756573745f736d7567676c6572) [![crates_downloads](https://camo.githubusercontent.com/075e31db45cefd1aae582910432bb1e87192af1bd2ecfa90f6417b20aaa5e7b4/68747470733a2f2f696d672e736869656c64732e696f2f6372617465732f642f726571756573745f736d7567676c65723f6c6f676f3d72757374)](https://camo.githubusercontent.com/075e31db45cefd1aae582910432bb1e87192af1bd2ecfa90f6417b20aaa5e7b4/68747470733a2f2f696d672e736869656c64732e696f2f6372617465732f642f726571756573745f736d7567676c65723f6c6f676f3d72757374) [![github_downloads](https://camo.githubusercontent.com/e5375b42b7c33e7cefc7e8ad62b107c20c0a11eb99bafbdcbba8c154e1618d99/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f646f776e6c6f6164732f736831796f2f726571756573745f736d7567676c65722f746f74616c3f6c6162656c3d646f776e6c6f616473266c6f676f3d676974687562)](https://camo.githubusercontent.com/e5375b42b7c33e7cefc7e8ad62b107c20c0a11eb99bafbdcbba8c154e1618d99/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f646f776e6c6f6164732f736831796f2f726571756573745f736d7567676c65722f746f74616c3f6c6162656c3d646f776e6c6f616473266c6f676f3d676974687562)

# Request smuggler

### Http request smuggling vulnerability scanner

[![](https://user-images.githubusercontent.com/54232788/126177471-151fade2-f7bb-4852-a106-59f35fe2b560.png)](https://user-images.githubusercontent.com/54232788/126177471-151fade2-f7bb-4852-a106-59f35fe2b560.png)

Based on the amazing [research](https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn) by [James Kettle](https://twitter.com/albinowax). The tool can help to find servers that may be vulnerable to request smuggling vulnerability.

## Usage

```auto
USAGE:
    request_smuggler [OPTIONS] --url <url>

FLAGS:
    -h, --help Prints help information
    -V, --version Prints version information

OPTIONS:
        --amount-of-payloads <amount-of-payloads> low/medium/all [default: low]
    -t, --attack-types <attack-types>
            [ClTeMethod, ClTePath, ClTeTime, TeClMethod, TeClPath, TeClTime] [default: "ClTeTime" "TeClTime"]

        --file <file>
            send request from a file
            you need to explicitly pass \r\n at the end of the lines
    -H, --header <headers> Example: -H 'one:one' 'two:two'
    -X, --method <method> [default: POST]
    -u, --url <url>
    -v, --verbose <verbose>
            0 - print detected cases and errors only,
            1 - print first line of server responses
            2 - print requests [default: 0]
        --verify <verify> how many times verify the vulnerability [default: 2]

```

## Installation

- Linux
  - from releases
  - from source code (rust should be installed)

git clone [https://github.com/Sh1Yo/request\_smuggler](https://github.com/Sh1Yo/request_smuggler) cd request\_smuggler cargo build --release

- using cargo install

cargo install request\_smuggler --version 0.1.0-alpha.2

- Mac
  - from source code (rust should be installed)

git clone [https://github.com/Sh1Yo/request\_smuggler](https://github.com/Sh1Yo/request_smuggler) cd request\_smuggler cargo build --release

- using cargo install

cargo install request\_smuggler --version 0.1.0-alpha.2

- Windows
  - from releases

## GitHub:

> **[GitHub - Sh1Yo/request\_smuggler: Http request smuggling vulnerability scanner](https://github.com/Sh1Yo/request_smuggler)**
>
> Http request smuggling vulnerability scanner