pentest-http-smuggling

# Pentest HTTP Smuggling ## Purpose Detect and exploit discrepancies between front-end proxies and back-end servers in HTTP request parsing. These attacks bypass security controls, poison caches, and hijack requests — entirely absent from standard taint analysis pipelines. ## Prerequisites ### Authorization Requirements - **Written authorization** with explicit scope for protocol-level testing - **Infrastructure awareness** — identify all reverse proxies, CDNs, load balancers in path - **Rollback plan** for cache poisoning tests (CDN purge access) - **Emergency contacts** for infrastructure team (smuggling can affect other users) ### Environment Setup - Python 3.x with raw socket capability for crafted HTTP requests - Burp Suite Professional with HTTP Request Smuggler extension - curl compiled with HTTP/2 support (`--http2-prior-knowledge`) - Turbo Intruder for timing-sensitive attacks - Network capture tool (Wireshark/tcpdump) for response analysis ## Core Workflow 1. **Stack Fingerprinting**: Identify reverse proxies (nginx, HAProxy, Cloudflare, AWS ALB), CDNs, load balancers. Determine HTTP version support (HTTP/1.1, HTTP/2) and parsing behavior. 2. **CL.TE Smuggling**: Craft requests where front-end uses Content-Length and back-end uses Transfer-Encoding. Observe differential parsing and request boundary confusion. 3. **TE.CL Smuggling**: Reverse scenario — front-end uses Transfer-Encoding, back-end uses Content-Length. Test with obfuscated TE headers. 4. **TE.TE Smuggling**: Both sides use Transfer-Encoding but one can be confused with header obfuscation (capitalization, whitespace, duplicate headers). 5. **HTTP/2 Downgrade**: Exploit H2-to-H1 translation at reverse proxies. Header injection via pseudo-headers, CRLF injection in H2 headers, request splitting through H2 CONTINUATION frames. 6. **Cache Poisoning**: Poison cached responses with attacker-controlled content. Test cache key vs cache content discrepancies. Verify with different client sessions. 7. **Host Header Attacks**: Host header injection, password reset poisoning, routing-based SSRF, web cache poisoning via ambiguous Host headers (WSTG-INPV-17). 8. **Impact Validation**: Demonstrate cache poisoning, credential theft, request hijacking, or security control bypass as PoC. ## WSTG Coverage | WSTG ID | Test Name | Status | |---------|-----------|--------| | WSTG-INPV-15 | HTTP Request Smuggling | ✅ | | WSTG-INPV-17 | Host Header Injection | ✅ | ## Tool Categories | Category | Tools | Purpose | |----------|-------|---------| | Smuggling Detection | smuggler.py, HTTP Request Smuggler (Burp) | Automated CL.TE/TE.CL detection | | HTTP/2 Testing | h2csmuggler, curl --http2, nghttp | H2 downgrade and desync attacks | | Timing Attacks | Turbo Intruder | Microsecond-precision request timing | | Raw Requests | Python sockets, netcat | Crafted malformed HTTP requests | | Cache Analysis | curl, custom scripts | Cache behavior verification | | Traffic Capture | Wireshark, tcpdump | Response boundary analysis | ## References - `references/tools.md` - Tool function signatures and parameters - `references/workflows.md` - Attack pattern definitions and test vectors