Contents
What is HTTP response smuggling?
HTTP Response Smuggling is a technique that attackers use to “smuggle” HTTP responses from a server to a client through an intermediary HTTP device that expects (or allows) a single response from the server. Both of these are possible when the browser uses a proxy server to access both sites.
What is an HTTP Desync attack?
HTTP Desync attacks abuse the way a chain of HTTP servers (i.e. front-end and back-end web application server deployments) interpret consecutive requests – especially the way HTTP servers determine the boundaries or length of each request.
What is HTML smuggling?
HTML smuggling works by exploiting the basic features of HTML5 and JavaScript that are present in web browsers. The core of the exploit is twofold: It uses the HTML5 download attribute to download a malicious file that’s disguised as a legitimate one, and it also uses JavaScript blobs in a similar fashion.
What is CL TE?
CL. TE. In this type of HTTP request smuggling, the front end processes the request using Content-Length header while backend processes the request using Transfer-Encoding header.
What is web cache poisoning attack?
Web cache poisoning is an advanced technique whereby an attacker exploits the behavior of a web server and cache so that a harmful HTTP response is served to other users. Once successful, they need to make sure that their response is cached and subsequently served to the intended victims.
How is request smuggling used in an attack?
Request smuggling attacks involve placing both the Content-Length header and the Transfer-Encoding header into a single HTTP request and manipulating these so that the front-end and back-end servers process the request differently. The exact way in which this is done depends on the behavior of the two servers:
Why are there so many HTTP request smuggling vulnerabilities?
Most HTTP request smuggling vulnerabilities arise because the HTTP specification provides two different ways to specify where a request ends: the Content-Length header and the Transfer-Encoding header. The Content-Length header is straightforward: it specifies the length of the message body in bytes. For example:
What can a smuggled HTTP request be used for?
In a real attack scenario, a smuggled request can be crafted to conduct phishing attacks, or steal data from a victim’s request and send that to an attacker-controlled server.
How to exploit HTTP request smuggling and hijack a session?
This method will also reveal the Front-End request rewriting. To be able to exploit the HTTP request smuggling and hijack a session, a few pre-requisites are needed: CL:TE Socket Poisoning. A part of the request should be reflected in the response. We need to find a request were a part of the request is reflected in the response.