httpsuite

Unified HTTP Security Testing Tool
Bypass • CRLF • CORS • Methods • Smuggle — all in a single binary.

Installation • Modules • Usage • Examples • Architecture • Credits

httpsuite combines the best ideas from multiple open-source HTTP security tools into a single Go binary. Instead of juggling separate tools with different flags, payload files, and output formats, run one tool with a shared workflow, shared client, synced payload support, and smarter triage.

Why It Is Useful

• Smart bypass filtering suppresses fake 200 or 3xx responses that still look like blocked templates
• sync-payloads refreshes current payloads from upstream projects into payloads/
• JSON output now carries richer bypass evidence such as reason, title, and fingerprint
• A shared HTTP client provides retries, proxy support, custom headers, and TLS handling across modules

Installation

From Source

git clone https://github.com/Aether-0/httpsuite.git
cd httpsuite
go build -o httpsuite .

Go Install

go install github.com/aether-0/httpsuite@latest

Move to PATH (optional)

sudo mv httpsuite /usr/local/bin/

Refresh Payload Files (optional)

httpsuite sync-payloads

Modules

Bypass

Tests a wide range of 403/401 bypass techniques against restricted endpoints:

• Header injection with IP, host, URL, origin, and proxy-style headers
• End-path and mid-path payload insertion
• Verb tampering and verb case switching
• Double URL encoding of path segments
• Path case switching
• Raw HTTP version probing with HTTP/1.0 and HTTP/1.1
• Smart suppression of fake success responses that still look like blocked pages

CRLF

Tests for CRLF injection by generating encoded path payloads and looking for a reflected canary header:

• Multiple encoded escape variants such as %0d%0a, %23%0d%0a, %u000d, %e5%98%8a%e5%98%8d, and more
• Reflected header detection using X-Injected-Header-By: httpsuite
• Works against single targets, files, or piped input

CORS

Detects several classes of CORS misconfiguration:

• Origin reflection
• Null-origin acceptance
• Wildcard ACAO, including credential-related misconfigurations
• Developer-backdoor origins
• Prefix and suffix domain tricks
• Subdomain trust issues
• Non-SSL and alternate-port origin handling
• Preflight inspection with OPTIONS

Methods

Enumerates allowed or interesting HTTP methods on target endpoints:

• Built-in list of 30+ methods
• Custom method lists with --methods
• Status filtering with --status
• Optional synced method payloads from payloads/bypass/httpmethods

Smuggle

Tests for HTTP request smuggling via HTTP/2 downgrade:

• Raw HTTP/2 TLS connection setup with ALPN
• Default and extended gadget banks
• Support for custom gadget files with --wordlist
• Synced gadget files from payloads/smuggle/
• Configurable detection timeout with --interval

Usage

httpsuite <command> [flags]

Commands

Global Flags

Module-Specific Flags

bypass

Notes:

• Verbose mode explains why blocked-template responses were suppressed.
• JSON output includes reason, title, and fingerprint fields for bypass findings.

cors

methods

smuggle

Notes:

• The smuggling module targets https:// endpoints that negotiate HTTP/2 over TLS.

sync-payloads

Examples

Bypass

# Basic 403/401 bypass scan
httpsuite bypass -u https://example.com/admin

# Focus on specific techniques
httpsuite bypass -u https://example.com/admin --techniques headers,endpaths,http-versions

# Show suppression reasons and richer bypass triage
httpsuite bypass -u https://example.com/admin -v -j

# Use a custom bypass IP
httpsuite bypass -u https://example.com/admin --bypass-ip 10.0.0.1

CRLF

# Basic CRLF scan
httpsuite crlf -u https://example.com

# Scan a URL list with higher concurrency
httpsuite crlf -l urls.txt -c 50

# Through a proxy
httpsuite crlf -u https://example.com -x http://127.0.0.1:8080

CORS

# Basic CORS scan
httpsuite cors -u https://example.com

# Deep scan with custom origin
httpsuite cors -u https://example.com --deep --origin https://attacker.com

# Multiple targets
httpsuite cors -l urls.txt -c 20

Methods

# Enumerate all built-in methods
httpsuite methods -u https://example.com

# Test specific methods and filter by status
httpsuite methods -u https://example.com --methods GET,POST,PUT,DELETE --status 200,201,405

# JSON output
httpsuite methods -u https://example.com -j -o results.json

Smuggle

# Basic smuggling scan
httpsuite smuggle -u https://example.com

# Extended gadget list with longer detection timeout
httpsuite smuggle -u https://example.com --extended --interval 10

# Custom gadget file
httpsuite smuggle -u https://example.com --wordlist gadgets.txt

Payload Sync

# Sync payloads into the default directory
httpsuite sync-payloads

# Sync into a custom payload directory
httpsuite sync-payloads --payload-dir payloads-custom

Run All Modules

# Full scan
httpsuite all -u https://example.com

# Full scan with verbose output and higher concurrency
httpsuite all -u https://example.com -v -c 20

Piping and Output

# Pipe targets from stdin
cat urls.txt | httpsuite cors
echo "https://example.com" | httpsuite methods

# Plain text output
httpsuite all -u https://example.com -o scan.log

# JSON output
httpsuite bypass -u https://example.com/admin -j -o bypass.json

Architecture

httpsuite/
├── main.go                      # Entry point
├── cmd/
│   └── root.go                  # CLI routing & flag parsing
├── internal/
│   ├── bypass/
│   │   ├── bypass.go            # Scanner logic, triage, raw HTTP version checks
│   │   └── payloads.go          # Embedded payloads + synced payload loaders
│   ├── crlf/
│   │   └── crlf.go              # Encoded CRLF payload generation and reflection checks
│   ├── cors/
│   │   └── cors.go              # Origin generation, preflight, response analysis
│   ├── methods/
│   │   └── methods.go           # Method enumeration logic
│   └── smuggle/
│       ├── smuggle.go           # HTTP/2 downgrade testing
│       └── gadgets.go           # Embedded gadget banks
├── pkg/
│   ├── common/
│   │   └── types.go             # Shared config and result types
│   ├── httpclient/
│   │   ├── client.go            # Shared HTTP client
│   │   └── summary.go           # Response fingerprinting and HTML normalization
│   ├── output/
│   │   └── output.go            # Banner, terminal, JSON, and file output
│   ├── payloadsync/
│   │   └── payloadsync.go       # Upstream payload downloader/extractor
│   └── utils/
│       └── utils.go             # URL helpers, case variants, file helpers
└── payloads/
    ├── bypass/                  # Synced bypass payload files
    └── smuggle/                 # Synced smuggle gadget files

How It Works

1. Input: accepts a single URL, a list file, or piped stdin
2. Dispatch: routes to a specific module or runs all modules in sequence
3. Shared Client: applies timeout, retries, proxy, headers, and TLS settings consistently
4. Concurrent Workers: each module runs with a worker pool controlled by -c
5. Triage: bypass responses are fingerprinted and compared against blocked baselines
6. Output: results stream to stdout and optionally to text or JSON output files

Credits

httpsuite is built by combining techniques and ideas from these projects:

Disclaimer

This tool is intended for authorized security testing and educational use only. Always obtain proper authorization before testing systems you do not own or manage.

License

MIT License — see LICENSE for details.