HTTP Request Smuggling

Cross-platform resources for HTTP Request Smuggling: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice HTTP Request Smuggling: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 20 challenges across 3 platforms — 1 HackTheBox · 16 PortSwigger · 3 TryHackMe. 1 with a Spanish writeup, 1 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — 0.CL request smuggling (Apprentice) · 🇬🇧
2. PortSwigger — Exploiting HTTP request smuggling to perform web cache deception (Apprentice) · 🇬🇧
3. PortSwigger — Exploiting HTTP request smuggling to perform web cache poisoning (Apprentice) · 🇬🇧
4. TryHackMe — HTTP Request Smuggling (Easy · ~60 min) · 🇬🇧
5. PortSwigger — Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability (Practitioner) · 🇬🇧
6. PortSwigger — Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/request-smuggling

HTB machines practicing HTTP Request Smuggling (1)

Machine	OS	Difficulty	Writeup
Sink	Linux	INSANE	🇪🇸 🇬🇧 📹

PortSwigger labs practicing HTTP Request Smuggling (16)

Lab	Difficulty	Topic	Official
0.CL request smuggling	APPRENTICE	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to perform web cache deception	APPRENTICE	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to perform web cache poisoning	APPRENTICE	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability	PRACTITIONER	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability	PRACTITIONER	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to capture other users’ requests	PRACTITIONER	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to deliver reflected XSS	PRACTITIONER	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to reveal front-end request rewriting	PRACTITIONER	HTTP Request Smuggling	Open
H2.CL request smuggling	PRACTITIONER	HTTP Request Smuggling	Open
HTTP request smuggling, basic CL.TE vulnerability	PRACTITIONER	HTTP Request Smuggling	Open
HTTP request smuggling, basic TE.CL vulnerability	PRACTITIONER	HTTP Request Smuggling	Open
HTTP request smuggling, confirming a CL.TE vulnerability via differential responses	PRACTITIONER	HTTP Request Smuggling	Open
HTTP request smuggling, confirming a TE.CL vulnerability via differential responses	PRACTITIONER	HTTP Request Smuggling	Open
HTTP request smuggling, obfuscating the TE header	PRACTITIONER	HTTP Request Smuggling	Open
HTTP/2 request smuggling via CRLF injection	PRACTITIONER	HTTP Request Smuggling	Open
HTTP/2 request splitting via CRLF injection	PRACTITIONER	HTTP Request Smuggling	Open

TryHackMe rooms practicing HTTP Request Smuggling (3)

Room	Difficulty	Type	Access	Official
HTTP Request Smuggling	EASY	Walkthrough	🟢 Free	Open
Request Smuggling: WebSockets	MEDIUM	Walkthrough	🔵 VIP	Open
HTTP/2 Request Smuggling	HARD	Walkthrough	🟢 Free	Open

---

← Back to the full glossary

Last updated: 2026-08-17