HTTP request smuggling
Desync probes for CL.TE / TE.CL / HTTP/2 downgrade. Lab or authorized target only. Do not desync a production CDN for fun.
Tags: smuggling, desync, http2
Controlled probes
Content-Length + Transfer-Encoding: chunked on the same request (CL.TE)Transfer-Encoding: chunked + obfuscated TE (xchunked, chunked\t, chunked\r\n)HTTP/2 request with Content-Length that a backend HTTP/1 parser honoursAbsolute-URI vs origin-form disagreement on the path
Source: https://portswigger.net/web-security/request-smuggling