Tools

giordy0424/cve-2023-25690_lab

HTTP Request Smuggling lab: Apache 2.4.55 CRLF injection

portswigger/http-request-smuggler

Burp Suite extension for automated detection and exploitation of HTTP request smuggling vulnerabilities, supporting HTTP/1.1 and HTTP/2-downgrade…

george0papasotiriou/cve-2026-1010-websocket-connection-smuggling-via-malformed-upgrade-header

Proof-of-concept exploit for CVE-2026-1010, demonstrating WebSocket connection smuggling and request splitting through a malformed Upgrade header…

theopaid/cve-2026-66752-http-request-smuggling-via-unparsed-transfer-encoding-values-tiny_http-

Security Advisory: HTTP Request Smuggling via Unparsed Transfer-Encoding Values (tiny_http)

theopaid/cve-2026-67182-http-request-smuggling-enables-front-end-access-control-bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass (rouille)

theopaid/cve-2026-67181-http-request-smuggling-via-transfer-encoding-desynchronization-rouille-

Security Advisory: HTTP Request Smuggling via Transfer-Encoding Desynchronization (rouille)

jmg0929/cve-2021-40346

PoC exploit for CVE-2021-40346: HAProxy integer overflow enabling HTTP request smuggling and ACL bypass. Includes analysis, reproduction steps, and…

pjt3591oo/cve-2026-40175-poc

Proof-of-concept demonstrating CRLF injection and HTTP request smuggling in Axios, chaining prototype pollution to achieve SSRF and access internal…

boianeduard/cve-2021-40346

HTTP Request Smuggling

razzlemouse/f5-big-ip-smuggleshell-cve-2023-46747-exploit

#F5-BIG-IP-CVE-2023-46747-Exploit – Unauthenticated RCE Python exploit & Nuclei template by Raguraman ✓ Automated TCP reverse shell (LHOST/LPORT)…

martinfabianionut/cve-2025-55315

Proof-of-concept exploit for CVE-2025-55315 (.NET HTTP Request Smuggling). Demonstrates how improperly parsed chunked encoding lets attackers smuggle…

zemarkhos/cve-2025-55315-poc-exploit

CVE-2025-55315 PoC Exploit

jlinebau/cve-2025-55315-scanner-monitor

Quick and Simple Scripts to Scan for Vulnerable Servers and Packet Level Monitors

sachinart/cve-2025-61882

Multi-threaded scanner for CVE-2025-61882 in Oracle E-Business Suite, exploiting HTTP request smuggling to achieve unauthenticated remote code…

dhmosfunk/http3onsteroids

PoC and lab environment for CVE-2023-25950: HTTP request smuggling via malformed header fields in HAProxy's HTTP/3 implementation, enabling DoS and…

abhisek3122/cve-2025-23167

Working exploit for CVE-2025-23167 – HTTP request smuggling in vulnerable Node.js 20.x versions before 20.19.2

oocyginxoo/cve-2023-25690-poc

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling…