domains / families / security / exploiting-http-request-smuggling

exploiting-http-request-smuggling

separate

Detects and exploits HTTP request smuggling caused by Content-Length/Transfer-Encoding parsing discrepancies between front-end and back-end servers, using Burp Suite Repeater (auto Content-Length disabled), the HTTP Request Smuggler extension, and smuggler.py. Use during authorized tests of multi-tier architectures behind a reverse proxy, load balancer, or CDN to find desync flaws and bypass front-end controls.

When to use

• During authorized penetration tests when the application sits behind a reverse proxy, load balancer, or CDN
• When testing infrastructure with multiple HTTP processors in the request chain (nginx + Apache, HAProxy + Gunicorn)
• For assessing applications for HTTP desynchronization vulnerabilities
• When other attack vectors are limited and you need to bypass front-end security controls
• During security assessments of multi-tier web architectures

Skill page

Source