Breaking the chains on HTTP Request Smuggler
Summary: PortSwigger released a major update to its HTTP Request Smuggler tool, adding an option to automatically attempt the non-deterministic and occasionally risky confirmation stage of a request smuggling attack and report a second issue titled HTTP Request Smuggling Confirmed when it succeeds. The update also adds a 'skip straight to poc' option for unpatched Apache Traffic Server, which Erlend Oftedal found goes undetected by the timing-based technique because it is internally inconsistent about prioritizing content-length versus chunked encoding, plus a 'pad everything' option that pads probe requests past 40kb and a new payload using the 'identity' encoding that Émile Fugulin suggested.
Why it matters: The timing-based scanning technique was built to have almost zero false negatives, but as vulnerable sites patched, its false-positive rate rose to annoying levels - so teams scanning at scale now have to choose between confirmed findings and unconfirmed ones that may still be real.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026