How to test HTTP smuggling using the payload from Smuggler with Turbo Intruder

[defparam]

How to test HTTP smuggling using the payload from Smuggler with Turbo Intruder

[shelld3v]

Also, sorry if bad English 🌝

[amralihassan740]

Why there is no answer ?
Did you know shelld3v how to use it?

[shelld3v]

I don't know :) But I think I am going to close this thing now since there is no answer. Gonna learn other stuff, hate Request smuggling with this bad response :)

[defparam]

Hey thanks for being patient,

This tool isn't an exploitation tool it is a recon tool. It simply finds problematic HTTP requests that should be looked into further. It doesn't stage or teach how to stage any desync attacks. It provides you with the payload of the HTTP request that is problematic and you are expected to know how to exploit using Turbo Intruder and other tools.

My intention with this project is not to teach the exploitation of desync attacks, it is just to search for them. However if you want to take the payload and use it for exploitation you have to know how to read the payload file using python in the Turbo Intruder script and issue the attack with the request. This information is out of scope for this project so am not covering it here.

[shelld3v]

OK, @defparam! Is there no other option except quiet and don't care about this issue? Very well, then I will close this soon.

Thanks for letting me know:)

[defparam]

To be clear, the point of this tool isn’t to actively exploit hosts. It’s to find potential issues and give you the payload which caused it. It’s not this project’s concern that you don’t know what to do with the payloads it produces and it’s not my mission to teach you how to use turbo intruder.