internal/

Package smuggle implements time-based HTTP request smuggling detection (CL.TE and TE.CL desync) using raw sockets, because net/http normalizes and forbids the conflicting Content-Length / Transfer-Encoding headers required.

Package wscheck implements a real WebSocket handshake to detect Cross-Site WebSocket Hijacking (CSWSH): a server that completes the upgrade handshake for a request bearing a forged cross-origin Origin header is not validating the Origin and may be hijackable.