So, to detect that we have found HTTP Request Smuggling, we must send a malformed request. The back-end processes this request and returns the expected response. The front-end rewrites the request, adding headers the back-end will expect. The process of sending a valid request is shown in the below diagram:Īs can be seen above, a valid request is sent. Once Burp has flagged HTTP Request Smuggling, we need to confirm that it is, in fact, there, and not a false positive.

When one of these responses times out, Burp will flag it as HTTP Request Smuggling.Īs can be seen in the below screenshot, the request has no response tab, indicating that the request timed out and HTTP Request Smuggling is present. It is true that sometimes this vulnerability can be tricky to exploit and demonstrate but with this write up I hope the concept will be clear.įirst let’s look at HTTP Request Smuggling being flagged by Burp Suite.īurp flags this as HTTP Request Smuggling when it sends requests with malformed Content-Length and Transfer-Encoding headers. This is often overlooked, or treated as a false positive due to a lack of understanding. When browsing through a web application using the Burp Suite web proxy you might notice that HTTP Request Smuggling is flagged in the Dashboard tab. The method of HTTP Request Smuggling I will demonstrate in this write up is known as CL:TE and, with this method, I will be performing Back-End Socket Poisoning.

To reduce complexity will only be providing detail about one method of Request Smuggling. The CL stands for the header value Content-Length and the TE value stands for the header Transfer-Encoding. There are also different variations of Request Smuggling, which are known by the abbreviations symbolising the headers used in the attack. The list goes on and, and, furthermore, I believe that other attack methods exist which still need to be explored. Server-Side Request Forgery (SSRF) is sometimes possible. Session hijacking (demonstrated in the exploitation section of this post, about halfway down the page). For example Cross-Site Scripting (XSS) where the attacker targets any users of the application rather than the attacker targeting a user directly. There are numerous attack methods using HTTP Request Smuggling. Rather than just identify the vulnerability and prove its existence to the client, I wanted to demonstrate it in action as well. I was carrying out some research whilst testing a web application that appeared vulnerable to HTTP Request Smuggling. This post covers my findings and, hopefully, sheds some light on the intricacies of HTTP Request Smuggling. What I found missing was practical, actionable, how-to references.

HTTP Request Smuggling is not a new issue, a 2005 white paper from Watchfire discusses it in detail and there are other resources too.

Burp suite kali manually send request