OWASP Hunting
Configuration & Design

HTTP Request Smuggling

HTTP request smuggling exploits disagreements between front-end and back-end servers about request boundaries to bypass security controls and poison caches.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

HTTP Request Smuggling occurs when a front-end and back-end server disagree about where one HTTP request ends and the next begins. By exploiting discrepancies in how they handle Content-Length and Transfer-Encoding headers, attackers can prefix content onto the next user's request, bypass security controls, and poison web caches.

Attack Vectors

  • Front-end/back-end server architectures (load balancers + app servers)
  • CDN edge servers (Akamai, Cloudflare) + origin servers
  • Reverse proxy configurations (Nginx/HAProxy + Apache/Tomcat)
  • AWS ALB and various backend combinations

Testing Methodology

  1. Send CL.TE probe: Content-Length underrepresents body, Transfer-Encoding: chunked used by backend
  2. Send TE.CL probe: Transfer-Encoding used by front-end, Content-Length by backend
  3. Measure timing differences indicating the backend is waiting for more data
  4. Use time-based and reflection-based techniques to confirm exploitability

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

CL.TE Detection
POST / HTTP/1.1 Host: target.com Content-Length: 6 Transfer-Encoding: chunked 0 X
TE.CL Detection
POST / HTTP/1.1 Host: target.com Content-Length: 3 Transfer-Encoding: chunked 1 X 0
TE Obfuscation
Transfer-Encoding: xchunkedTransfer-Encoding : chunkedTransfer-Encoding: chunked Transfer-Encoding: x

Indicators of Vulnerability

  • Request times out or returns 400 error with timing matching smuggled byte
  • Subsequent requests receive responses intended for the smuggled prefix
  • Security controls bypass demonstrated for requests poisoned by smuggled content

Detection Guidance

Ensure front-end and back-end servers are configured to reject ambiguous requests. Disable Transfer-Encoding at the front-end if not required.

Mitigation & Remediation

  • Normalize ambiguous requests at the front-end before forwarding
  • Use HTTP/2 end-to-end where possible (eliminates CL/TE ambiguity)
  • Configure front-end to reject requests with both Content-Length and Transfer-Encoding headers
  • Keep proxy and server software updated

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)