vulns.co
/
mcp by GKData.io

Back to Gadgets

HTTP request smuggling desync

CL.TE, TE.CL, TE.TE on an HTTP/1 hop behind a proxy. Prove with a harmless probe that only you can observe (a unique header echo or a canary request you own). Do not poison other users.

Tags: smuggling, desync, cache, http

Typical severity: P1-P3

What it becomes

Front-end and origin disagree on Content-Length vs Transfer-Encoding. That desync is a request queue gadget, not a party trick.

Where to look

  • CDN to origin HTTP/1
  • AWS ALB / CloudFront quirks
  • nginx + gunicorn
  • HAProxy

Chains

  • Cache poison / XSS: Smuggled request writes a response that the next user, or the cache, receives.
  • Credential theft: Capture a victim request that was appended onto your smuggled prefix. Do not do this against real users. Lab or two sessions you own.
  • Bypass ACL: Inner request hits an internal route the front-end would have blocked.

Notes

  • Use PortSwigger's detection probes and a target you are allowed to desync. Production poison is how you get banned.
  • h2c smuggling is a sibling gadget (see h2csmuggler).

Back to Gadgets