http request smuggling
http request smuggling
Front-end and back-end disagree on where one request ends. We hide a second request inside the first, and the back-end serves it to the next victim.
← all categories
Request smuggling exploits ambiguity in how chained HTTP servers (front-end proxy, back-end app)
parse the boundary between consecutive requests. By crafting Content-Length and
Transfer-Encoding headers that desync the two parsers, an attacker can prepend traffic onto the
next user's request.
The labs cover CL.TE, TE.CL, TE.TE, and the modern HTTP/2 downgrade variants. Impact: response queue poisoning, credential capture, cache poisoning, and XSS injection into another user's session.
// labs
0 live · 0 total> no labs in this category yet, still cooking.