HTTP Smuggling labs

A practical playbook — from recon to proof of concept.

1. 1

   Differential and timing detection

   Send an ambiguous request with both Content-Length and Transfer-Encoding and an incomplete chunk. If the back-end hangs waiting for bytes that never come, there's a desync.

   Transfer-Encoding: chunked\r\nContent-Length: 4\r\n\r\n1\r\nA\r\nX   →   timeout = smuggling likely

2. 2

   Confirm the variant

   Send a request that only poisons under one of the two interpretations to tell CL.TE from TE.CL without false positives.

   CL.TE: body `0\r\n\r\nGET /404 HTTP/1.1\r\nX: `  →  if the next request gets a 404, it's CL.TE

3. 3

   Poison the request queue

   Leave your malicious prefix in the back-end's buffer so it's prepended to the next user's request arriving over that connection.

   smuggled prefix: GET /admin HTTP/1.1\r\nHost: target\r\nFoo: (waits for the rest of the victim's request)

4. 4

   Steal other users' requests

   Make the prefix capture the victim's full request (with their session cookie) and reflect it in a resource you can read.

   Smuggle → POST /comment with the victim's request as the body → you read their Cookie in the comment

5. 5

   Cache poisoning via smuggling

   Combine the desync with a cacheable response so the cache stores your content and serves it to all users.

   Desync so the /static/main.js response is a 302 to evil.com → cached for everyone

6. 6

   Automate with HTTP Request Smuggler

   Use Burp's extension (James Kettle, PortSwigger) to scan, confirm the variant and generate the PoC with Turbo Intruder without hand-crafting the CRLFs.

   Burp → Extensions → HTTP Request Smuggler → 'Smuggle probe' / 'Launch smuggle attack'