{"id":13542120,"url":"https://github.com/defparam/smuggler","last_synced_at":"2025-05-15T13:08:07.317Z","repository":{"id":37288896,"uuid":"270866336","full_name":"defparam/smuggler","owner":"defparam","description":"Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3","archived":false,"fork":false,"pushed_at":"2024-01-02T12:46:17.000Z","size":75,"stargazers_count":1940,"open_issues_count":18,"forks_count":313,"subscribers_count":31,"default_branch":"master","last_synced_at":"2025-04-15T05:32:09.386Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/defparam.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-06-09T00:42:03.000Z","updated_at":"2025-04-15T04:45:42.000Z","dependencies_parsed_at":"2024-08-01T10:26:16.118Z","dependency_job_id":null,"html_url":"https://github.com/defparam/smuggler","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/defparam%2Fsmuggler","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/defparam%2Fsmuggler/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/defparam%2Fsmuggler/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/defparam%2Fsmuggler/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/defparam","download_url":"https://codeload.github.com/defparam/smuggler/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254346624,"owners_count":22055808,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T10:01:01.619Z","updated_at":"2025-05-15T13:08:02.308Z","avatar_url":"https://github.com/defparam.png","language":"Python","readme":"```\n  ______                         _              \n / _____)                       | |             \n( (____  ____  _   _  ____  ____| | _____  ____ \n \\____ \\|    \\| | | |/ _  |/ _  | || ___ |/ ___)\n _____) ) | | | |_| ( (_| ( (_| | || ____| |    \n(______/|_|_|_|____/ \\___ |\\___ |\\_)_____)_|    \n                    (_____(_____|               \n\n     @defparam\n```\n\n# Smuggler\n\nAn HTTP Request Smuggling / Desync testing tool written in Python 3\n\n## Acknowledgements\n\nA special thanks to [James Kettle](https://skeletonscribe.net/) for his [research and methods into HTTP desyncs](https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn)\n\nAnd a special thanks to [Ben Sadeghipour](https://www.nahamsec.com/) for beta testing Smuggler and for allowing me to discuss my work at [Nahamcon 2020](https://nahamcon.com)\n\n## IMPORTANT\nThis tool does not guarantee no false-positives or false-negatives. Just because a mutation may report OK does not mean there isn't a desync issue, but more importantly just because the tool indicates a potential desync issue does not mean there definitely exists one. The script may encounter request processors from large entities (i.e. Google/AWS/Yahoo/Akamai/etc..) that may show false positive results.\n\n## Installation\n\n1) git clone https://github.com/defparam/smuggler.git\n2) cd smuggler\n3) python3 smuggler.py -h\n\n## Example Usage\n\nSingle Host:\n```\npython3 smuggler.py -u \u003cURL\u003e\n```\n\nList of hosts:\n```\ncat list_of_hosts.txt | python3 smuggler.py\n```\n\n## Options\n\n```\nusage: smuggler.py [-h] [-u URL] [-v VHOST] [-x] [-m METHOD] [-l LOG] [-q]\n                   [-t TIMEOUT] [--no-color] [-c CONFIGFILE]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -u URL, --url URL     Target URL with Endpoint\n  -v VHOST, --vhost VHOST\n                        Specify a virtual host\n  -x, --exit_early      Exit scan on first finding\n  -m METHOD, --method METHOD\n                        HTTP method to use (e.g GET, POST) Default: POST\n  -l LOG, --log LOG     Specify a log file\n  -q, --quiet           Quiet mode will only log issues found\n  -t TIMEOUT, --timeout TIMEOUT\n                        Socket timeout value Default: 5\n  --no-color            Suppress color codes\n  -c CONFIGFILE, --configfile CONFIGFILE\n                        Filepath to the configuration file of payloads\n```\n\nSmuggler at a minimum requires either a URL via the -u/--url argument or a list of URLs piped into the script via stdin.\nIf the URL specifies `https://` then Smuggler will connect to the host:port using SSL/TLS. If the URL specifies `http://`\nthen no SSL/TLS will be used at all. If only the host is specified, then the script will default to `https://`\n\nUse -v/--vhost \\\u003chost\u003e to specify a different host header from the server address\n\nUse -x/--exit_early to exit the scan of a given server when a potential issue is found. In piped mode smuggler will just continue to the next host on the list\n\nUse -m/--method \\\u003cmethod\u003e to specify a different HTTP verb from POST (i.e GET/PUT/PATCH/OPTIONS/CONNECT/TRACE/DELETE/HEAD/etc...)\n\nUse -l/--log \\\u003cfile\u003e to write output to file as well as stdout\n\nUse -q/--quiet reduce verbosity and only log issues found\n\nUse -t/--timeout \\\u003cvalue\u003e to specify the socket timeout. The value should be high enough to conclude that the socket is hanging, but low enough to speed up testing (default: 5)\n\nUse --no-color to suppress the output color codes printed to stdout (logs by default don't include color codes)\n\nUse -c/--configfile \\\u003cconfigfile\u003e to specify your smuggler mutation configuration file (default: default.py)\n\n## Config Files\nConfiguration files are python files that exist in the ./config directory of smuggler. These files describe the content of the HTTP requests and the transfer-encoding mutations to test.\n\n\nHere is example content of default.py:\n```python\ndef render_template(gadget):\n\tRN = \"\\r\\n\"\n\tp = Payload()\n\tp.header  = \"__METHOD__ __ENDPOINT__?cb=__RANDOM__ HTTP/1.1\" + RN\n\t# p.header += \"Transfer-Encoding: chunked\" +RN\t\n\tp.header += gadget + RN\n\tp.header += \"Host: __HOST__\" + RN\n\tp.header += \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36\" + RN\n\tp.header += \"Content-type: application/x-www-form-urlencoded; charset=UTF-8\" + RN\n\tp.header += \"Content-Length: __REPLACE_CL__\" + RN\n\treturn p\n\n\nmutations[\"nameprefix1\"] = render_template(\" Transfer-Encoding: chunked\")\nmutations[\"tabprefix1\"] = render_template(\"Transfer-Encoding:\\tchunked\")\nmutations[\"tabprefix2\"] = render_template(\"Transfer-Encoding\\t:\\tchunked\")\nmutations[\"space1\"] = render_template(\"Transfer-Encoding : chunked\")\n\nfor i in [0x1,0x4,0x8,0x9,0xa,0xb,0xc,0xd,0x1F,0x20,0x7f,0xA0,0xFF]:\n\tmutations[\"midspace-%02x\"%i] = render_template(\"Transfer-Encoding:%cchunked\"%(i))\n\tmutations[\"postspace-%02x\"%i] = render_template(\"Transfer-Encoding%c: chunked\"%(i))\n\tmutations[\"prespace-%02x\"%i] = render_template(\"%cTransfer-Encoding: chunked\"%(i))\n\tmutations[\"endspace-%02x\"%i] = render_template(\"Transfer-Encoding: chunked%c\"%(i))\n\tmutations[\"xprespace-%02x\"%i] = render_template(\"X: X%cTransfer-Encoding: chunked\"%(i))\n\tmutations[\"endspacex-%02x\"%i] = render_template(\"Transfer-Encoding: chunked%cX: X\"%(i))\n\tmutations[\"rxprespace-%02x\"%i] = render_template(\"X: X\\r%cTransfer-Encoding: chunked\"%(i))\n\tmutations[\"xnprespace-%02x\"%i] = render_template(\"X: X%c\\nTransfer-Encoding: chunked\"%(i))\n\tmutations[\"endspacerx-%02x\"%i] = render_template(\"Transfer-Encoding: chunked\\r%cX: X\"%(i))\n\tmutations[\"endspacexn-%02x\"%i] = render_template(\"Transfer-Encoding: chunked%c\\nX: X\"%(i))\n```\n\nThere are no input arguments yet on specifying your own customer headers and user-agents. It is recommended to create your own configuration file based on default.py and modify it to your liking.\n\nSmuggler comes with 3 configuration files: default.py (fast), doubles.py (niche, slow), exhaustive.py (very slow)\ndefault.py is the fastest because it contains less mutations.\n\nspecify configuration files using the -c/--configfile \\\u003cconfigfile\u003e command line option\n\n## Payloads Directory\nInside the Smuggler directory is the payloads directory. When Smuggler finds a potential CLTE or TECL desync issue, it will automatically dump a binary txt file of the problematic payload in the payloads directory. All payload filenames are annotated with the hostname, desync type and mutation type. Use these payloads to netcat directly to the server or to import into other analysis tools.\n\n## Helper Scripts\nAfter you find a desync issue feel free to use my Turbo Intruder desync scripts found Here: https://github.com/defparam/tiscripts\n`DesyncAttack_CLTE.py` and `DesyncAttack_TECL.py` are great scripts to help stage a desync attack\n\n## License\nThese scripts are released under the MIT license. See [LICENSE](https://github.com/defparam/smuggler/blob/master/LICENSE).\n","funding_links":[],"categories":["Exploitation","Weapons","Python","Bugs","Python (1887)","其他_安全与渗透","Web","Tools"],"sub_categories":["Request Smuggling","Tools","网络服务_其他"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdefparam%2Fsmuggler","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdefparam%2Fsmuggler","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdefparam%2Fsmuggler/lists"}