HTTP Request Smuggling

Recursos cross-platform para HTTP Request Smuggling: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

Esta página agrega los recursos para practicar HTTP Request Smuggling de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

Cobertura: 20 retos en 3 plataformas — 1 HackTheBox · 16 PortSwigger · 3 TryHackMe. 1 con writeup en español, 1 con writeup en vídeo.

​

Por dónde empezar

Ordenado por dificultad real. A igual nivel, primero el lab aislado, después la room guiada y por último la máquina completa.

1. PortSwigger — 0.CL request smuggling (Apprentice) · 🇬🇧
2. PortSwigger — Exploiting HTTP request smuggling to perform web cache deception (Apprentice) · 🇬🇧
3. PortSwigger — Exploiting HTTP request smuggling to perform web cache poisoning (Apprentice) · 🇬🇧
4. TryHackMe — HTTP Request Smuggling (Easy · ~60 min) · 🇬🇧
5. PortSwigger — Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability (Practitioner) · 🇬🇧
6. PortSwigger — Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability (Practitioner) · 🇬🇧

​

Recursos curados

Fuente	Enlace
PortSwigger	https://portswigger.net/web-security/request-smuggling

​

Máquinas HTB que practican HTTP Request Smuggling (1)

Máquina	SO	Dificultad	Writeup
Sink	Linux	INSANE	🇪🇸 🇬🇧 📹

​

Labs PortSwigger que practican HTTP Request Smuggling (16)

Lab	Dificultad	Topic	Oficial
0.CL request smuggling	APPRENTICE	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to perform web cache deception	APPRENTICE	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to perform web cache poisoning	APPRENTICE	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to capture other users’ requests	PRACTITIONER	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to deliver reflected XSS	PRACTITIONER	HTTP Request Smuggling	Abrir
Exploiting HTTP request smuggling to reveal front-end request rewriting	PRACTITIONER	HTTP Request Smuggling	Abrir
H2.CL request smuggling	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, basic CL.TE vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, basic TE.CL vulnerability	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, confirming a CL.TE vulnerability via differential responses	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, confirming a TE.CL vulnerability via differential responses	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP request smuggling, obfuscating the TE header	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP/2 request smuggling via CRLF injection	PRACTITIONER	HTTP Request Smuggling	Abrir
HTTP/2 request splitting via CRLF injection	PRACTITIONER	HTTP Request Smuggling	Abrir

​

Rooms TryHackMe que practican HTTP Request Smuggling (3)

Room	Dificultad	Tipo	Acceso	Oficial
HTTP Request Smuggling	EASY	Walkthrough	🟢 Free	Abrir
Request Smuggling: WebSockets	MEDIUM	Walkthrough	🔵 VIP	Abrir
HTTP/2 Request Smuggling	HARD	Walkthrough	🟢 Free	Abrir

---

← Volver al glosario completo

Última actualización: 2026-08-17