Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-inpv-15
Testing for HTTP Splitting/Smuggling
Passed 17 of 22 test cases with the skill, and 11 of 22 without it.
and 5 more in the full report
6 fixed11 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
According to standard OWASP Web Security Testing Guide risk metrics, what are the CVSS v3 base scores assigned to HTTP Request Smuggling and Cache Poisoning via Smuggling?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns a CVSS base score of 9.8 to HTTP Request Smuggling. | Missed | Passed |
| Assigns a CVSS base score of 8.1 to Cache Poisoning via Smuggling. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-INPV-15
Testing for HTTP Splitting/Smuggling
HTTP Request Smuggling occurs when front-end and back-end servers interpret HTTP request boundaries differently. HTTP Response Splitting injects CRLF characters to manipulate headers. Both can lead to cache poisoning, session hijacking, XSS, or bypassing security controls.
#!/bin/bash
TARGET="https://target.com"
echo "[*] Testing HTTP Response Splitting..."
# CRLF injection payloads
curl -s "$TARGET/redirect?url=http://target.com%0d%0aSet-Cookie:%20malicious=true"
curl -s "$TARGET/redirect?url=http://target.com%0d%0a%0d%0a<html>injected</html>"
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.