Security Assessment Report
GG Advanced IT Security  ·  ggsec.de
SAST 0.0s DAST 88.2s 6 requests 2 confirmed vulns 4 likely 6 SAST targets GGSec Cortex v0.9 Beta
F
Security
Rating

Executive Summary

GGSec Cortex identified 2 confirmed and 4 likely vulnerabilities in smuggle_probe.php. Every confirmed finding is evidence-backed — proven by a live proof-of-concept or a baseline-difference control (a forged/malicious request is accepted while a matched control is rejected), so false positives are minimised. Likely findings are confirmed marker-leak / parser-differential signals without a full request-hijack proof — they warrant manual verification, not an emergency response. Immediate remediation is recommended.
💰
Business Impact
Account / administrator takeover
🧰
Exploitation Complexity
Low — reachable by a remote attacker
🎯
Likelihood
High — confirmed findings have a live proof-of-concept
⚠
Overall Risk
Critical · max CVSS 8.9

Assessment Scope

📄
Target
smuggle_probe.php
🌐
Base URL
http://172.26.203.184:8888
🔗
Endpoints tested
1
📤
Total requests
6
⚙
HTTP methods
SMUGGLE
🛡
Vulnerability classes
1
🔑
Authentication
Unauthenticated
🔎
SAST duration
0.0s
⚡
DAST duration
88.2s
📅
Scan completed
2026-07-10 21:12

Scan Timeline

21:12:51
Scan started
21:12:51
SAST replay (cached plan)
21:12:51
DAST probing started
21:12:51
GGC-VULN-CF6 confirmed — REQUEST_SMUGGLING CL.TE
21:12:51
GGC-VULN-24F confirmed — REQUEST_SMUGGLING TE.CL
21:12:51
DAST probing completed (88.2s, 6 requests)
21:12:52
Report generated

Overview

⚠
2
Confirmed Vulns
❔
4
Likely (review)
💀
1
Critical SAST
🔥
1
High SAST
💻
0
RCE
🗃
0
SQLi
⚡
0
XSS
🌐
0
SSRF
📄
0
XXE
🎭
0
CSRF
📡
0
JSONP
🔓
0
Auth Bypass
📤
6
Total Requests
Confirmed vulns by sink type DAST
REQUEST_SMUGGLING: 2 2 total
REQUEST_SMUGGLING2
SAST impact distribution SAST
INFORMATION_DISCLOSURE
4
AUTH_BYPASS
2
DAST hit rate by sink DAST
REQUEST_SMUGGLING
6/6

Risk Matrix

Likelihood ▼ / Impact ▶NegligibleMinorModerateMajorSevere
Almost certain1
Likely1
Possible
Unlikely
Rare

Remediation Plan

IDFindingCVSSPrioritySLA
GGC-VULN-CF6 🔍 REQUEST_SMUGGLING CL.TE 8.9 P1 Within 7 days
GGC-VULN-24F 🔍 REQUEST_SMUGGLING TE.CL 8.9 P1 Within 7 days

Compliance Coverage

Each finding mapped to OWASP Top 10 2021, PCI-DSS v4.0, ISO/IEC 27001:2022 and GDPR. References are indicative for audit scoping, not a certification statement.

OWASP Top 10 (2021)# FindingsPCI-DSS v4.0ISO/IEC 27001:2022GDPR
A03:2021 – Injection 6 PCI-DSS v4.0 Req 6.2.4 ISO/IEC 27001:2022 A.8.28 GDPR Art. 32 (security of processing)

SAST — Attack Surface

SAST confidence = static taint-flow certainty (source→sink), not runtime proof. "Confirmed" is reserved for DAST findings the engine actually exploited.

#ParameterSinkRiskCVSSStatic confidenceExploit.ImpactLocation
1 0.CL (3 accepted variants) 🔍 REQUEST_SMUGGLING Medium 5.4 MEDIUM Medium Conditional INFORMATION_DISCLOSURE smuggle: 172.26.203.184
2 CL.CL 🔍 REQUEST_SMUGGLING Medium 5.4 MEDIUM Medium Conditional INFORMATION_DISCLOSURE smuggle: 172.26.203.184
3 CL.TE 🔍 REQUEST_SMUGGLING Critical 8.9 HIGH Taint-flow Direct AUTH_BYPASS smuggle: 172.26.203.184
4 CL.TE (3 accepted variants) 🔍 REQUEST_SMUGGLING Medium 5.4 MEDIUM Medium Conditional INFORMATION_DISCLOSURE smuggle: 172.26.203.184
5 TE.CL 🔍 REQUEST_SMUGGLING High 8.9 HIGH High Direct AUTH_BYPASS smuggle: 172.26.203.184
6 TE.TE (3 accepted variants) 🔍 REQUEST_SMUGGLING Medium 5.4 MEDIUM Medium Conditional INFORMATION_DISCLOSURE smuggle: 172.26.203.184

Endpoint Summary

EndpointRequestsFindingsRisk
http://172.26.203.184:8888/ 6 🔍 REQUEST_SMUGGLING HIGH

DAST — Vulnerability Details

🔍 GGC-VULN-A18 4.6 MEDIUM P2 Likely REQUEST_SMUGGLING 0.CL (3 accepted variants) smuggle: 172.26.203.184 1/1 hits ▼
Flow
The 0.CL (3 accepted variants) framing was accepted and a smuggle marker leaked into a subsequent response (protocol ambiguity / likely desync). A real parsing discrepancy, but the full request-hijack impact is unverified — confirm manually before treating as exploitable.
Impact
INFORMATION_DISCLOSURE — Conditional
CWE / CVSS
CWE-444 HTTP Request Smuggling — marker-leak / protocol ambiguity (unverified desync)  ·  CVSS 4.6 Medium (Base 5.4 Medium)
The front-end and back-end disagree on where a request ends (ambiguous Content-Length/Transfer-Encoding), letting an attacker smuggle a second request past the front-end — request hijacking, control bypass, or cache poisoning.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RC:U
ⓘ Base 5,4 → Effective 4,6 — potential (E:U/RC:U).
Compliance Impact
A03:2021 – Injection
PCI-DSS v4.0 Req 6.2.4  ·  ISO/IEC 27001:2022 A.8.28  ·  GDPR Art. 32 (security of processing)
MITRE ATT&CK
T1190 Exploit Public-Facing Application
Initial Access
Certainty / Access
Likely  ·  🔓 Unauthenticated
Evidence strength
75%Medium evidenceEvidence score 75/100
  • +75 Native desync-engine confidence (marker-leak)
Proof of Concept
Reproduce:
curl -i -X POST 'http://172.26.203.184:8888/' --data '0.CL (3 accepted variants)'
Reflection @ offset 71 — via smuggle-marker-leak:
…arker-leak / parser-differential (likely desync — verify) — 0.CL (3 accepted variants) against 172.26.203.184:8888 (native confidence 75%, detecti…
Evidence (live response):
[SMUGGLE] Marker-leak / parser-differential (likely desync — verify) — 0.CL (3 accepted variants) against 172.26.203.184:8888 (native confidence 75%, detection marker-leak, timing 1ms, delta 1ms). 0.CL smuggle marker leaked into a subsequent response via gadget '/' — Content-Le…
Remediation
Reject ambiguous HTTP messages and make the front-end and back-end parse requests identically.
  • Reject any request that carries BOTH Content-Length and Transfer-Encoding, or duplicate/conflicting CL or TE headers (respond 400, don't forward).
  • Normalize/dechunk requests at the front-end and re-emit a single unambiguous framing to the back-end; disable unsupported Transfer-Encoding variants (identity, obfuscated, folded).
  • Ensure the reverse proxy/CDN and origin server use the same HTTP parser and version (prefer HTTP/2 end-to-end to eliminate downgrade desync).
  • Disable unsafe back-end connection reuse: close the upstream connection after any malformed or ambiguously-framed request instead of keeping it in the pool.
  • Patch and reconfigure the reverse proxy / origin (known CL.TE/TE.CL/TE.TE/0.CL issues are fixed in current releases); add WAF rules that drop conflicting framing headers.
Refs: CWE-444 · OWASP: HTTP Request Smuggling · PortSwigger: HTTP request smuggling / desync attacks
ResultMethodURLPayloadStatusTimeDetectionDB
⚠ VULN SMUGGLE http://172.26.203.184:8888/ 
0.CL (3 accepted variants)
 200 0ms smuggle-marker-leak —
🔍 GGC-VULN-79D 4.6 MEDIUM P2 Likely REQUEST_SMUGGLING CL.CL smuggle: 172.26.203.184 1/1 hits ▼
Flow
The CL.CL framing was accepted and a smuggle marker leaked into a subsequent response (protocol ambiguity / likely desync). A real parsing discrepancy, but the full request-hijack impact is unverified — confirm manually before treating as exploitable.
Impact
INFORMATION_DISCLOSURE — Conditional
CWE / CVSS
CWE-444 HTTP Request Smuggling — marker-leak / protocol ambiguity (unverified desync)  ·  CVSS 4.6 Medium (Base 5.4 Medium)
The front-end and back-end disagree on where a request ends (ambiguous Content-Length/Transfer-Encoding), letting an attacker smuggle a second request past the front-end — request hijacking, control bypass, or cache poisoning.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RC:U
ⓘ Base 5,4 → Effective 4,6 — potential (E:U/RC:U).
Compliance Impact
A03:2021 – Injection
PCI-DSS v4.0 Req 6.2.4  ·  ISO/IEC 27001:2022 A.8.28  ·  GDPR Art. 32 (security of processing)
MITRE ATT&CK
T1190 Exploit Public-Facing Application
Initial Access
Certainty / Access
Likely  ·  🔓 Unauthenticated
Evidence strength
75%Medium evidenceEvidence score 75/100
  • +75 Native desync-engine confidence (marker-leak)
Proof of Concept
Reproduce:
curl -i -X POST 'http://172.26.203.184:8888/' --data 'CL.CL'
Reflection @ offset 71 — via smuggle-marker-leak:
…arker-leak / parser-differential (likely desync — verify) — CL.CL against 172.26.203.184:8888 (native confidence 75%, detecti…
Evidence (live response):
[SMUGGLE] Marker-leak / parser-differential (likely desync — verify) — CL.CL against 172.26.203.184:8888 (native confidence 75%, detection marker-leak, timing 0ms, delta -1ms). Smuggled marker leaked into subsequent response (CL.CL) without clear timing delta (baseline=1ms, probe…
Remediation
Reject ambiguous HTTP messages and make the front-end and back-end parse requests identically.
  • Reject any request that carries BOTH Content-Length and Transfer-Encoding, or duplicate/conflicting CL or TE headers (respond 400, don't forward).
  • Normalize/dechunk requests at the front-end and re-emit a single unambiguous framing to the back-end; disable unsupported Transfer-Encoding variants (identity, obfuscated, folded).
  • Ensure the reverse proxy/CDN and origin server use the same HTTP parser and version (prefer HTTP/2 end-to-end to eliminate downgrade desync).
  • Disable unsafe back-end connection reuse: close the upstream connection after any malformed or ambiguously-framed request instead of keeping it in the pool.
  • Patch and reconfigure the reverse proxy / origin (known CL.TE/TE.CL/TE.TE/0.CL issues are fixed in current releases); add WAF rules that drop conflicting framing headers.
Refs: CWE-444 · OWASP: HTTP Request Smuggling · PortSwigger: HTTP request smuggling / desync attacks
ResultMethodURLPayloadStatusTimeDetectionDB
⚠ VULN SMUGGLE http://172.26.203.184:8888/ 
CL.CL
 200 0ms smuggle-marker-leak —
🔍 GGC-VULN-CF6 8.9 HIGH P1 Confirmed REQUEST_SMUGGLING CL.TE smuggle: 172.26.203.184 1/1 hits ▼
Flow
The front-end and back-end disagree on request boundaries (CL.TE); a crafted Content-Length/Transfer-Encoding mismatch smuggles a second request past the front-end — request hijacking, security-control bypass, cache poisoning, or credential capture.
Impact
AUTH_BYPASS — Direct
CWE / CVSS
CWE-444 HTTP Request Smuggling (front-end/back-end desync)  ·  CVSS 8.9 High
The front-end and back-end disagree on where a request ends (ambiguous Content-Length/Transfer-Encoding), letting an attacker smuggle a second request past the front-end — request hijacking, control bypass, or cache poisoning.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H/RC:C
Compliance Impact
A03:2021 – Injection
PCI-DSS v4.0 Req 6.2.4  ·  ISO/IEC 27001:2022 A.8.28  ·  GDPR Art. 32 (security of processing)
MITRE ATT&CK
T1190 Exploit Public-Facing Application
Initial Access
Certainty / Access
Confirmed  ·  🔓 Unauthenticated
Evidence strength
92%High evidenceEvidence score 92/100
  • +92 Native desync-engine confidence (timing-differential)
Proof of Concept
Reproduce:
curl -i -X POST 'http://172.26.203.184:8888/' --data 'CL.TE'
Reflection @ offset 56 — via smuggle-timing-differential:
[SMUGGLE] Confirmed HTTP desync (timing-differential) — CL.TE against 172.26.203.184:8888 (native confidence 92%, detecti…
Evidence (live response):
[SMUGGLE] Confirmed HTTP desync (timing-differential) — CL.TE against 172.26.203.184:8888 (native confidence 92%, detection timing-differential, timing 8007ms, delta 8006ms). Timing-differential desync (CL.TE): baseline=1ms vs desync-probe=8007ms (~timeout 8000ms). Smuggle marker…
Remediation
Reject ambiguous HTTP messages and make the front-end and back-end parse requests identically.
  • Reject any request that carries BOTH Content-Length and Transfer-Encoding, or duplicate/conflicting CL or TE headers (respond 400, don't forward).
  • Normalize/dechunk requests at the front-end and re-emit a single unambiguous framing to the back-end; disable unsupported Transfer-Encoding variants (identity, obfuscated, folded).
  • Ensure the reverse proxy/CDN and origin server use the same HTTP parser and version (prefer HTTP/2 end-to-end to eliminate downgrade desync).
  • Disable unsafe back-end connection reuse: close the upstream connection after any malformed or ambiguously-framed request instead of keeping it in the pool.
  • Patch and reconfigure the reverse proxy / origin (known CL.TE/TE.CL/TE.TE/0.CL issues are fixed in current releases); add WAF rules that drop conflicting framing headers.
Refs: CWE-444 · OWASP: HTTP Request Smuggling · PortSwigger: HTTP request smuggling / desync attacks
ResultMethodURLPayloadStatusTimeDetectionDB
⚠ VULN SMUGGLE http://172.26.203.184:8888/ 
CL.TE
 200 0ms smuggle-timing-differential —
🔍 GGC-VULN-DA4 4.6 MEDIUM P2 Likely REQUEST_SMUGGLING CL.TE (3 accepted variants) smuggle: 172.26.203.184 1/1 hits ▼
Flow
The CL.TE (3 accepted variants) framing was accepted and a smuggle marker leaked into a subsequent response (protocol ambiguity / likely desync). A real parsing discrepancy, but the full request-hijack impact is unverified — confirm manually before treating as exploitable.
Impact
INFORMATION_DISCLOSURE — Conditional
CWE / CVSS
CWE-444 HTTP Request Smuggling — marker-leak / protocol ambiguity (unverified desync)  ·  CVSS 4.6 Medium (Base 5.4 Medium)
The front-end and back-end disagree on where a request ends (ambiguous Content-Length/Transfer-Encoding), letting an attacker smuggle a second request past the front-end — request hijacking, control bypass, or cache poisoning.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RC:U
ⓘ Base 5,4 → Effective 4,6 — potential (E:U/RC:U).
Compliance Impact
A03:2021 – Injection
PCI-DSS v4.0 Req 6.2.4  ·  ISO/IEC 27001:2022 A.8.28  ·  GDPR Art. 32 (security of processing)
MITRE ATT&CK
T1190 Exploit Public-Facing Application
Initial Access
Certainty / Access
Likely  ·  🔓 Unauthenticated
Evidence strength
75%Medium evidenceEvidence score 75/100
  • +75 Native desync-engine confidence (marker-leak)
Proof of Concept
Reproduce:
curl -i -X POST 'http://172.26.203.184:8888/' --data 'CL.TE (3 accepted variants)'
Reflection @ offset 71 — via smuggle-marker-leak:
…arker-leak / parser-differential (likely desync — verify) — CL.TE (3 accepted variants) against 172.26.203.184:8888 (native confidence 75%, detecti…
Evidence (live response):
[SMUGGLE] Marker-leak / parser-differential (likely desync — verify) — CL.TE (3 accepted variants) against 172.26.203.184:8888 (native confidence 75%, detection marker-leak, timing 0ms, delta -1ms). Smuggled marker leaked into subsequent response (CL.TE (tab-after-colon)) without…
Remediation
Reject ambiguous HTTP messages and make the front-end and back-end parse requests identically.
  • Reject any request that carries BOTH Content-Length and Transfer-Encoding, or duplicate/conflicting CL or TE headers (respond 400, don't forward).
  • Normalize/dechunk requests at the front-end and re-emit a single unambiguous framing to the back-end; disable unsupported Transfer-Encoding variants (identity, obfuscated, folded).
  • Ensure the reverse proxy/CDN and origin server use the same HTTP parser and version (prefer HTTP/2 end-to-end to eliminate downgrade desync).
  • Disable unsafe back-end connection reuse: close the upstream connection after any malformed or ambiguously-framed request instead of keeping it in the pool.
  • Patch and reconfigure the reverse proxy / origin (known CL.TE/TE.CL/TE.TE/0.CL issues are fixed in current releases); add WAF rules that drop conflicting framing headers.
Refs: CWE-444 · OWASP: HTTP Request Smuggling · PortSwigger: HTTP request smuggling / desync attacks
ResultMethodURLPayloadStatusTimeDetectionDB
⚠ VULN SMUGGLE http://172.26.203.184:8888/ 
CL.TE (3 accepted variants)
 200 0ms smuggle-marker-leak —
🔍 GGC-VULN-24F 8.9 HIGH P1 Confirmed REQUEST_SMUGGLING TE.CL smuggle: 172.26.203.184 1/1 hits ▼
Flow
The front-end and back-end disagree on request boundaries (TE.CL); a crafted Content-Length/Transfer-Encoding mismatch smuggles a second request past the front-end — request hijacking, security-control bypass, cache poisoning, or credential capture.
Impact
AUTH_BYPASS — Direct
CWE / CVSS
CWE-444 HTTP Request Smuggling (front-end/back-end desync)  ·  CVSS 8.9 High
The front-end and back-end disagree on where a request ends (ambiguous Content-Length/Transfer-Encoding), letting an attacker smuggle a second request past the front-end — request hijacking, control bypass, or cache poisoning.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H/RC:C
Compliance Impact
A03:2021 – Injection
PCI-DSS v4.0 Req 6.2.4  ·  ISO/IEC 27001:2022 A.8.28  ·  GDPR Art. 32 (security of processing)
MITRE ATT&CK
T1190 Exploit Public-Facing Application
Initial Access
Certainty / Access
Confirmed  ·  🔓 Unauthenticated
Evidence strength
80%Medium evidenceEvidence score 80/100
  • +80 Native desync-engine confidence (timing-differential)
Proof of Concept
Reproduce:
curl -i -X POST 'http://172.26.203.184:8888/' --data 'TE.CL'
Reflection @ offset 56 — via smuggle-timing-differential:
[SMUGGLE] Confirmed HTTP desync (timing-differential) — TE.CL against 172.26.203.184:8888 (native confidence 80%, detecti…
Evidence (live response):
[SMUGGLE] Confirmed HTTP desync (timing-differential) — TE.CL against 172.26.203.184:8888 (native confidence 80%, detection timing-differential, timing 5024ms, delta 5023ms). Time-based confirmation (TE.CL): smuggled GET /?sleep=5 delayed the round-trip to 5024ms (baseline=1ms) â…
Remediation
Reject ambiguous HTTP messages and make the front-end and back-end parse requests identically.
  • Reject any request that carries BOTH Content-Length and Transfer-Encoding, or duplicate/conflicting CL or TE headers (respond 400, don't forward).
  • Normalize/dechunk requests at the front-end and re-emit a single unambiguous framing to the back-end; disable unsupported Transfer-Encoding variants (identity, obfuscated, folded).
  • Ensure the reverse proxy/CDN and origin server use the same HTTP parser and version (prefer HTTP/2 end-to-end to eliminate downgrade desync).
  • Disable unsafe back-end connection reuse: close the upstream connection after any malformed or ambiguously-framed request instead of keeping it in the pool.
  • Patch and reconfigure the reverse proxy / origin (known CL.TE/TE.CL/TE.TE/0.CL issues are fixed in current releases); add WAF rules that drop conflicting framing headers.
Refs: CWE-444 · OWASP: HTTP Request Smuggling · PortSwigger: HTTP request smuggling / desync attacks
ResultMethodURLPayloadStatusTimeDetectionDB
⚠ VULN SMUGGLE http://172.26.203.184:8888/ 
TE.CL
 200 0ms smuggle-timing-differential —
🔍 GGC-VULN-F0B 4.6 MEDIUM P2 Likely REQUEST_SMUGGLING TE.TE (3 accepted variants) smuggle: 172.26.203.184 1/1 hits ▼
Flow
The TE.TE (3 accepted variants) framing was accepted and a smuggle marker leaked into a subsequent response (protocol ambiguity / likely desync). A real parsing discrepancy, but the full request-hijack impact is unverified — confirm manually before treating as exploitable.
Impact
INFORMATION_DISCLOSURE — Conditional
CWE / CVSS
CWE-444 HTTP Request Smuggling — marker-leak / protocol ambiguity (unverified desync)  ·  CVSS 4.6 Medium (Base 5.4 Medium)
The front-end and back-end disagree on where a request ends (ambiguous Content-Length/Transfer-Encoding), letting an attacker smuggle a second request past the front-end — request hijacking, control bypass, or cache poisoning.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RC:U
ⓘ Base 5,4 → Effective 4,6 — potential (E:U/RC:U).
Compliance Impact
A03:2021 – Injection
PCI-DSS v4.0 Req 6.2.4  ·  ISO/IEC 27001:2022 A.8.28  ·  GDPR Art. 32 (security of processing)
MITRE ATT&CK
T1190 Exploit Public-Facing Application
Initial Access
Certainty / Access
Likely  ·  🔓 Unauthenticated
Evidence strength
75%Medium evidenceEvidence score 75/100
  • +75 Native desync-engine confidence (marker-leak)
Proof of Concept
Reproduce:
curl -i -X POST 'http://172.26.203.184:8888/' --data 'TE.TE (3 accepted variants)'
Reflection @ offset 71 — via smuggle-marker-leak:
…arker-leak / parser-differential (likely desync — verify) — TE.TE (3 accepted variants) against 172.26.203.184:8888 (native confidence 75%, detecti…
Evidence (live response):
[SMUGGLE] Marker-leak / parser-differential (likely desync — verify) — TE.TE (3 accepted variants) against 172.26.203.184:8888 (native confidence 75%, detection marker-leak, timing 0ms, delta -1ms). Smuggled marker leaked into subsequent response (TE.TE) without clear timing delt…
Remediation
Reject ambiguous HTTP messages and make the front-end and back-end parse requests identically.
  • Reject any request that carries BOTH Content-Length and Transfer-Encoding, or duplicate/conflicting CL or TE headers (respond 400, don't forward).
  • Normalize/dechunk requests at the front-end and re-emit a single unambiguous framing to the back-end; disable unsupported Transfer-Encoding variants (identity, obfuscated, folded).
  • Ensure the reverse proxy/CDN and origin server use the same HTTP parser and version (prefer HTTP/2 end-to-end to eliminate downgrade desync).
  • Disable unsafe back-end connection reuse: close the upstream connection after any malformed or ambiguously-framed request instead of keeping it in the pool.
  • Patch and reconfigure the reverse proxy / origin (known CL.TE/TE.CL/TE.TE/0.CL issues are fixed in current releases); add WAF rules that drop conflicting framing headers.
Refs: CWE-444 · OWASP: HTTP Request Smuggling · PortSwigger: HTTP request smuggling / desync attacks
ResultMethodURLPayloadStatusTimeDetectionDB
⚠ VULN SMUGGLE http://172.26.203.184:8888/ 
TE.TE (3 accepted variants)
 200 0ms smuggle-marker-leak —

Security Headers

HeaderStatusRiskRecommendation
Content-Security-Policy ✗ MISSING HIGH Prevents XSS/injection. Use nonce or strict-dynamic.
X-Frame-Options ✗ MISSING MEDIUM Prevents clickjacking. Use DENY or SAMEORIGIN.
X-Content-Type-Options ✗ MISSING LOW Prevents MIME sniffing. Set to nosniff.
Strict-Transport-Security ✗ MISSING MEDIUM Enforces HTTPS. min-age=31536000; includeSubDomains.
Referrer-Policy ✗ MISSING LOW Limits referrer leakage. strict-origin-when-cross-origin.
Permissions-Policy ✗ MISSING LOW Restrict unused browser features (camera, mic, geo).