Back to Details

hunt-http-smuggling

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

17. HTTP REQUEST SMUGGLING

17. HTTP 请求走私

Lowest dup rate. $5K–$30K. PortSwigger research by James Kettle.
重复提交率最低。$5K–$30K。James Kettle 的 PortSwigger 研究。

CL.TE (Content-Length front, Transfer-Encoding back)

CL.TE（前端 Content-Length，后端 Transfer-Encoding）

http
POST / HTTP/1.1
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED
http
POST / HTTP/1.1
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

Detection

检测

1. Burp extension: HTTP Request Smuggler
2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe
3. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body
1. Burp extension: HTTP Request Smuggler
2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe
3. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body

Impact Chain

影响链

Poison next request → access admin as victim
Steal credentials → capture victim's session
Cache poisoning → stored XSS at scale
Poison next request → access admin as victim
Steal credentials → capture victim's session
Cache poisoning → stored XSS at scale

Target-Suitability Matrix (2026 reality check)

目标适用性矩阵（2026 年现实核验）

The classic CL.TE / TE.CL payloads are NOT universally exploitable in 2026. Modern proxies are RFC 9112 strict by default. Fingerprint the front-end BEFORE investing time.
Front-endCL.TETE.CLH2.CLH2.TENotes
Nginx ≥ 1.21NONOpartial (H2 ingress)partialRFC-strict; rejects CL+TE with HTTP 400. Verified locally on Nginx 1.27 — all 9 documented variants killed by front-end (docs/verification/phase2h-smuggling-cachepoison.md).
Caddy 2.xNONO——Hardened by default
Envoy ≥ 1.20NONOpartialpartialHardened in most paths
HAProxy ≤ 2.4✓✓——Vulnerable, see CVE-2021-40346
AWS ALB + specific upstreampartialpartial✓✓Several disclosed-paid reports 2022-2024
Cloudflare → S3 / Lambda chains——✓✓H2-downgrade attacks remain viable
Older F5 BIG-IP (TMM < 16)✓———Vendor advisories
Citrix ADC / NetScaler (older firmware)✓✓——Disclosed in 2020-2022
Squid 3.x✓———Older deployments
Apache Traffic Server (older)✓✓✓✓PortSwigger research
Apache mod_proxy_ajp → Tomcat————Cross-protocol HTTP→AJP desync (CVE-2022-26377); smuggled request is opaque to the WAF and reaches internal AJP admin/status paths that lack the external auth controls
Custom Python / Go proxies✓✓——Frequently miss RFC enforcement
经典的 CL.TE / TE.CL payload 在 2026 年并非普遍可用。现代代理默认严格遵循 RFC 9112。在投入时间之前，应先识别前端。
前端CL.TETE.CLH2.CLH2.TE备注
Nginx ≥ 1.21否否部分适用（H2 ingress）部分适用严格遵循 RFC；遇到 CL+TE 时返回 HTTP 400。已在 Nginx 1.27 本地验证——前端拦截了所有 9 种有文档记录的变体（docs/verification/phase2h-smuggling-cachepoison.md）。
Caddy 2.x否否——默认已加固
Envoy ≥ 1.20否否部分适用部分适用大多数路径已加固
HAProxy ≤ 2.4✓✓——存在漏洞，参见 CVE-2021-40346
AWS ALB + 特定上游部分适用部分适用✓✓2022—2024 年间已有数份公开披露的付费报告
Cloudflare → S3 / Lambda 链——✓✓H2 降级攻击仍然可行
较旧的 F5 BIG-IP（TMM < 16）✓———厂商公告
Citrix ADC / NetScaler（较旧固件）✓✓——2020—2022 年间已披露
Squid 3.x✓———较旧的部署环境
Apache Traffic Server（较旧版本）✓✓✓✓PortSwigger 研究
Apache mod_proxy_ajp → Tomcat————跨协议 HTTP→AJP 失步（CVE-2022-26377）；走私请求对 WAF 不可见，并能到达缺少外部认证控制的内部 AJP 管理/状态路径
自定义 Python / Go 代理✓✓——经常未严格执行 RFC

Operator fingerprint quick-check

操作人员指纹快速检查

bash
curl -sI https://target/ | grep -i "Server:"
  • nginx/1.21+
    , 
    Caddy
    , 
    envoy
    → CL/TE classic is dead — pivot to H2.CL/H2.TE if the front-end speaks HTTP/2, or look for legacy proxies upstream
  • HAProxy
    , header points to AWS/CDN → run the full payload matrix
  • No Server header → assume hardened, but run a single quick 
    space-before-colon
    probe; if it doesn't 400, dig deeper
bash
curl -sI https://target/ | grep -i "Server:"
  • nginx/1.21+
    、
    Caddy
    、
    envoy
    → 经典 CL/TE 攻击已失效——如果前端支持 HTTP/2，则转向 H2.CL/H2.TE，或者检查上游是否存在旧版代理
  • HAProxy
    、请求头指向 AWS/CDN → 运行完整的 payload 矩阵
  • 没有 Server 请求头 → 假设其已加固，但应运行一次快速的 
    space-before-colon
    探测；如果没有返回 400，则继续深入排查

H2.CL / H2.TE (the modern dominant vector)

H2.CL / H2.TE（现代主要攻击向量）

H2-downgrade smuggling attacks rely on the front-end speaking HTTP/2 to the client and HTTP/1.1 to origin. The downgrade introduces CL/TE confusion because HTTP/2's frame-length headers don't survive the conversion cleanly. Most CDN+origin chains in 2024-2026 use this exact topology.
Tools that send HTTP/2 raw frames (Burp Pro's HTTP Request Smuggler extension, 
h2csmuggler
, 
smuggler.py
) are the right starting point against CDN-fronted targets. Avoid HTTP/1.1-only test clients (curl, raw sockets) against H2-front-ended targets — you'll send the wrong protocol entirely.
H2 降级走私攻击依赖于前端面向客户端使用 HTTP/2，而面向 origin 使用 HTTP/1.1。这种降级会引入 CL/TE 混淆，因为 HTTP/2 的帧长度请求头在转换过程中无法被完整保留。2024—2026 年的大多数 CDN+origin 链均采用这种拓扑结构。
对于以 CDN 为前端的目标，应首先使用能够发送 HTTP/2 原始帧的工具（Burp Pro 的 HTTP Request Smuggler 扩展、
h2csmuggler
、
smuggler.py
）。不要对采用 H2 前端的目标使用仅支持 HTTP/1.1 的测试客户端（curl、raw sockets），否则发送的将是完全错误的协议。

Mass credential harvesting — the "collector gadget"

大规模凭据收集——“collector gadget”

The highest-impact smuggling outcome needs no per-victim interaction. Instead of blindly poisoning the queue, smuggle a request aimed at a back-end handler that echoes the full request — a search endpoint that reflects headers, or a redirect that mirrors the request line. The next victim's headers (
Cookie
, 
Authorization
, 
X-Access-Token
) get attributed to your smuggled request, and the reflecting handler returns them in a response you read. Repeated on a busy keep-alive socket, this harvests live credentials from arbitrary users at scale — and it works even through a CDN (Akamai/Cloudflare) when the CDN↔origin hop desyncs. Chains to 
hunt-ato
.
影响最大的走私结果无需与每位受害者单独交互。不要盲目污染请求队列，而应走私一个指向会回显完整请求的后端处理器的请求，例如反射请求头的搜索端点，或镜像请求行的重定向。下一位受害者的请求头（
Cookie
、
Authorization
、
X-Access-Token
）会被归因到你的走私请求上，而反射处理器会在你可读取的响应中返回这些内容。在繁忙的 keep-alive 连接上重复执行，即可大规模收集任意用户的实时有效凭据——即使 CDN↔origin 链路发生失步，经由 CDN（Akamai/Cloudflare）时也仍然有效。可与 
hunt-ato
链式组合。

Related Skills & Chains

相关 Skill 与链式用法

  • hunt-cache-poison
     — Smuggling + cache is the canonical critical chain; one smuggled request becomes the cached response for every subsequent victim. Chain primitive: CL.TE smuggle a request whose response body contains attacker HTML/JS → front-end cache stores it under a popular URL (
    /
    , 
    /login
    ) → de-sync poisoning where the smuggled request becomes the cached response for the next N victims, persisting for the cache TTL.
  • hunt-auth-bypass
     — Smuggling reaches internal-only routes that the front-end WAF/auth-proxy filters out. Chain primitive: smuggle 
    GET /admin/users HTTP/1.1
    past the front-end ACL that blocks external 
    /admin/*
    → backend processes the smuggled request as if from a trusted internal source → bypass front-end auth by smuggling internal-routed request → admin data in the response queue.
  • hunt-idor
     — Smuggling attaches the NEXT user's session cookies to an attacker-controlled request path. Chain primitive: smuggle 
    GET /api/me HTTP/1.1
    with no cookies → backend pairs it with the next legitimate user's incoming connection cookies → victim's session cookie attached to attacker's smuggled request → attacker reads the response containing victim's PII/tokens.
  • hunt-xss
     — Smuggling injects XSS payloads into the response stream of the next victim without ever appearing in a URL parameter. Chain primitive: smuggled request body contains reflected payload that the backend renders into the next response in the queue → next visitor to 
    /
    receives attacker HTML inline → reflected XSS at every visitor without any URL parameter visible to them or to logs.
  • security-arsenal
     — Reach for the smuggling payload bank (CL.TE / TE.CL / TE.TE obfuscations, H2.CL downgrade probes, h2csmuggler one-liners, Burp HTTP Request Smuggler extension config) and the time-delay confirmation template before manual hex-editing.
  • triage-validation
     — Run the Pre-Severity Gate before claiming Critical: the smuggled-request effect MUST land on a request issued by a different client/session, not your own follow-up. A timing delta in your own browser alone is parser disagreement, not exploitable smuggling.
  • hunt-cache-poison
    ——走私 + 缓存是典型的严重漏洞链；一次走私请求会成为之后每位受害者收到的缓存响应。链式原语：通过 CL.TE 走私一个响应体中包含攻击者 HTML/JS 的请求 → 前端缓存将其存储在常用 URL（
    /
    、
    /login
    ）下 → 通过失步投毒，使走私请求成为接下来 N 位受害者收到的缓存响应，并在缓存 TTL 期间持续存在。
  • hunt-auth-bypass
    ——走私可访问仅限内部使用的路由，而这些路由会被前端 WAF/认证代理过滤掉。链式原语：走私 
    GET /admin/users HTTP/1.1
    ，绕过阻止外部 
    /admin/*
    访问的前端 ACL → 后端将走私请求视为来自可信内部源进行处理 → 绕过前端认证，并从响应队列中获取管理员数据。
  • hunt-idor
    ——走私可将下一位用户的会话 Cookie 附加到攻击者控制的请求路径。链式原语：走私不带 Cookie 的 
    GET /api/me HTTP/1.1
    → 后端将其与下一位合法用户连接携带的 Cookie 配对 → 受害者的会话 Cookie 被附加到攻击者的走私请求上 → 攻击者读取包含受害者 PII/令牌的响应。
  • hunt-xss
    ——走私可将 XSS payload 注入下一位受害者的响应流中，无需出现在任何 URL 参数里。链式原语：走私请求体包含反射 payload，后端将其渲染进队列中的下一份响应 → 下一位访问 
    /
    的访问者会内联收到攻击者的 HTML → 无需 URL 参数即可对每位访问者实施反射 XSS，用户和日志中也看不到任何 URL 参数。
  • security-arsenal
    ——在手动进行十六进制编辑之前，使用其中的走私 payload 库（CL.TE / TE.CL / TE.TE 混淆方式、H2.CL 降级探测、h2csmuggler 单行命令、Burp HTTP Request Smuggler 扩展配置）以及时间延迟确认模板。
  • triage-validation
    ——在将漏洞判定为 Critical 之前运行 Pre-Severity Gate：走私请求产生的影响必须作用于另一位客户端/会话发出的请求，而不能是你自己的后续请求。仅仅在自身浏览器中观察到时间差，只能说明解析器存在分歧，并不能证明存在可利用的走私。