Deep Dive into HTTP Request Smuggling Attacks
Table of Contents
- Introduction to HTTP Request Smuggling/Desync Attacks
- TCP Stream of HTTP requests
- Content-Length vs Transfer-Encoding
- Content-Length
- Transfer-Encoding
- Transfer-Encoding over Content-Length ⚠️
- Desynchronization
- CL.TE Attack ⚔️
- Identification of the CL.TE attack
- Exploitation of a CL.TE attack
- TE.TE Attack ⚔️
- Identification of the TE.TE attack
- Exploitation of the TE.TE attack
- TE.CL Attack ⚔️
- Identification of the TE.CL attack
- Exploitation and Exercise
- Vulnerable Software
- Identification of the Guanicorn 20.0.4
- Exploitation of the Guanicorn 20.0.4 and challenge
- Exploitation of Request Smuggling
- Challenge
- The attack
- Request Smuggling Tools & Prevention
- Mitigations and recommended steps