Web › Module 6 › Lesson 3
HTTP Request Smuggling Basics
When front-end and back-end disagree on where one HTTP request ends
Opening
Two parsers, one TCP stream
HTTP request smuggling (desync) abuses disagreement between a reverse proxy and an origin server about Content-Length vs Transfer-Encoding. Malicious bytes “hide” a second request that the back end treats as a new client.
1. How smuggling arises
Classic pairs: • CL.TE — front end uses Content-Length; back end prefers Transfer-Encoding: chunked • TE.CL — the opposite • TE.TE — both support TE, but one can be confused with obfuscated TE headers HTTP/2 downgrading and H2.CL / H2.TE variants appear when an HTTP/2 edge speaks HTTP/1.1 upstream.
2. Impact
Bypass front-end controls
Poison the next user’s request path or headers.
Cache / XSS pivot
Smuggle a request that stores attacker content for another victim.
Credential theft
Capture another user’s request that lands in your smuggled “socket”.
3. Finding & preventing
Labs use timing differentials and response differentials carefully. Prevention: normalize HTTP at the edge, reject ambiguous TE+CL, disable HTTP/1.1 downgrade where possible, and keep proxy/origin on consistent parsing rules. Never run smuggling payloads against production systems you do not own—desync can disrupt real users.
Knowledge Check
CL.TE smuggling means:
Multiple choice