HTTP Request Smuggling

Two servers reading the same bytes and disagreeing on where the request ends is the entire attack. A front-end proxy forwards traffic to a back-end server over a reused connection. If they parse the request boundary differently, part of what you sent gets treated by the back-end as the start of the next request. That leftover piece is your smuggled request, and it attaches itself to whoever's connection comes through next, which is often another user.

The disagreement lives in two headers that both claim to say how long the body is. Content-Length gives a byte count. Transfer-Encoding: chunked says the body arrives in size-prefixed chunks ending with a zero chunk. A request should never send both. When it does, the RFC says prefer Transfer-Encoding, but plenty of servers ignore that, and any mismatch between front and back is exploitable.

CL.TE and TE.CL

Name the desync by which server trusts which header. In CL.TE, the front-end uses Content-Length and the back-end uses Transfer-Encoding. In TE.CL, it is reversed. That ordering decides how you craft the smuggle, so identify it before building a payload.

Here is a CL.TE body. The front-end reads Content-Length: 6 and forwards all six bytes plus the smuggled part it thinks is filler. The back-end reads chunked, sees the 0 terminator, ends the request there, and treats G as the beginning of the next request on that connection.

TE.CL flips it. The front-end honors the chunked encoding and passes the whole thing, while the back-end stops after Content-Length bytes and leaves your trailing request queued. Getting a proxy to honor a header it should ignore usually means obfuscating the Transfer-Encoding line so only one of the two servers recognizes it.

$Transfer-Encoding:[tab]chunked

Detect it without breaking things

Do not confirm a smuggle by poisoning real users. Use the timing technique instead: send a payload that, if the back-end desyncs, forces it to wait for bytes that never arrive. A normal server responds fast. A vulnerable one hangs for the timeout.

A big, repeatable delay that only appears with the malformed body is your signal. It is safe because you are stalling your own connection, not injecting into anyone else's. Burp's smuggler extension automates exactly this probe across CL.TE and TE.CL.

Once confirmed, the payoffs are serious: prepend a request that captures the next user's headers including their session cookie, bypass a front-end that blocks /admin by smuggling the path past it, or poison the response queue so users get each other's pages. HTTP/2 downgrade smuggling extends all of this to modern stacks where a front-end speaks h2 and rewrites to h1 on the way back.