hunt-smuggling

Hunt: HTTP Request Smuggling

Assumes hunt-core for the scope gate, two-account rule, confirmation gate, enumeration limits, stop conditions, wiki protocol, FIND output, and Deadends. Do not re-derive any of that here.

Wiki

qmd_query "HTTP request smuggling desync CL.TE TE.CL TE.TE CL.0 HTTP/2 downgrade" via wiki-search MCP

Hub: [[web-moc]] (live web index). Primary page: [[http-request-smuggling]]. Payload arsenal: wiki/payloads/smuggling.md. Anchors: [[reverse-proxy-attacks]].

Attack surface signals

Smuggling needs a front-end that parses headers differently from the back-end: a CDN/WAF/LB in front of an origin, HTTP/1.1 keep-alive reused across users, or an HTTP/2 edge that downgrades to HTTP/1.1. Odds rise wherever both Transfer-Encoding and Content-Length are honored somewhere in the chain.

Rank before probing. Not all front-end/back-end pairs are equally likely:

• HTTP/2 edge downgrading to HTTP/1.1 origin - H2.CL / H2.TE re-open a surface a hardened H1 front-end closes; highest yield on modern stacks.
• Multiple hops in the chain - CDN -> WAF -> LB -> origin; each added parser is another chance for two of them to disagree.
• Mismatched server software front vs back - e.g. a normalising proxy in front of a lenient app server, or vice versa.
• Connection reuse to the back-end - a poisoned prefix only reaches a victim if the back-end pools/keep-alives the connection across requests.
• Endpoints behind the edge auth/path filter - a desync that bypasses a front-end control is worth more than one that does not reach anything privileged.

Methodology

1. Detect (timing, safe): send a deliberately malformed TE/CL and watch for a back-end read timeout.

# CL.TE probe (front-end uses CL, back-end uses TE) - delays if vulnerable
POST / HTTP/1.1
Content-Length: 4
Transfer-Encoding: chunked

1
A
0

# TE.CL probe (front-end TE, back-end CL)
Transfer-Encoding: chunked  +  Content-Length: 6 ; body: "0\r\n\r\nX"

1. Confirm (differential): smuggle a prefix that prepends to the victim's request, then issue a normal request and observe the poisoned response (e.g. your G prepended to their path -> 404 on GET ...). See the confirmation gate below - a timing delay alone is never the finding.
2. TE.TE: obfuscate the header so one server ignores it (Transfer-Encoding: xchunked, Transfer-Encoding, Transfer-Encoding:\tchunked, double TE).
3. HTTP/2: test H2.CL / H2.TE (smuggle via H2 that downgrades to H1), and H2 request splitting via CRLF in header values.
4. CL.0 / H2.0: back-end ignores body -> smuggle a full second request.
5. Exploit: capture other users' requests (steal session cookies/headers), bypass front-end auth/path controls, cache-poison via smuggled response, escalate a reflected issue to stored.
6. Distill when confirmed - reusable obfuscation or H2-desync variant, GENERIC, no client host: python3 scripts/wiki-stage.py --kind technique --slug <slug> --target-page techniques/web/http-request-smuggling.md