Web Security
HTTP Request Smuggling
When a proxy and a backend disagree on where one HTTP request ends, an attacker slips a hidden request between them. Learn CL.TE and TE.CL desync, cache poisoning, access control bypass, and how Cloudflare was smuggled in 2019.
Advanced50 min6 lessons1 hands-on
First lesson free. The full module is part of Pro.
You'll be able to
- ✓Explain the CL.TE and TE.CL desync models and what causes them
- ✓Craft a smuggled request using Content-Length and Transfer-Encoding conflict
- ✓Reach internal admin endpoints by smuggling a hidden request prefix
- ✓Poison a shared cache by smuggling a crafted response into the pipeline