HTTP request smuggling
Front-end and origin disagree on Content-Length vs Transfer-Encoding. Prove with a harmless probe on a connection you own. Do not poison other users.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
- A smuggled request was stored as a cached response - HTTP request smuggling
Playbooks
- HTTP Request Smuggling - Exploit disagreements between a front-end proxy and back-end server on where one request ends, to poison the connection of the next user.
Tools
- Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.
Payloads
- HTTP request smuggling - Desync probes for CL.TE / TE.CL / HTTP/2 downgrade. Lab or authorized target only. Do not desync a production CDN for fun.
Bypasses
- HTTP desync probes - Front-end vs origin disagreement on CL vs TE. Detect with a harmless timeout or echo. Do not poison other users.
Questions
Can I capture victim cookies?
Not on a live bounty with real users. Lab, or two sessions you own. Detection plus a documented hop mismatch is the first report.
HTTP/2?
h2 to the edge, HTTP/1 to origin is where CL/TE reappears. h2c smuggling is a sibling gadget.
This page is the linked pack hunt_brief("smuggling") returns on the MCP connector. Authorized testing only.