{"id":"hunt-http-smuggling","name":"hunt-http-smuggling","summary":"HTTPリクエストのスミグル(CL.TE、TE. を追いかけます)CL、H2.CL、H2.TE)などです。","body":"## 17. HTTP REQUEST SMUGGLING\n> Lowest dup rate. $5K–$30K. PortSwigger research by James Kettle.\n\n### CL.TE (Content-Length front, Transfer-Encoding back)\n```http\nPOST / HTTP/1.1\nContent-Length: 13\nTransfer-Encoding: chunked\n\n0\n\nSMUGGLED\n```\n\n### Detection\n```\n1. Burp extension: HTTP Request Smuggler\n2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe\n3. Manual timing: CL.TE probe + ~10s delay = backend waiting for rest of body\n```\n\n### Impact Chain\n```\nPoison next request → access admin as victim\nSteal credentials → capture victim's session\nCache poisoning → stored XSS at scale\n```\n\n---\n\n## Target-Suitability Matrix (2026 reality check)\n\nThe classic CL.TE / TE.CL payloads are NOT universally exploitable in 2026. Modern proxies are RFC 9112 strict by default. Fingerprint the front-end BEFORE investing time.\n\n| Front-end | CL.TE | TE.CL | H2.CL | H2.TE | Notes |\n|---|---|---|---|---|---|\n| **Nginx ≥ 1.21** | NO | NO | partial (H2 ingress) | partial | RFC-strict; rejects CL+TE with HTTP 400. Verified locally on Nginx 1.27 — all 9 documented variants killed by front-end ([docs/verification/phase2h-smuggling-cachepoison.md](../../docs/verification/phase2h-smuggling-cachepoison.md)). |\n| **Caddy 2.x** | NO | NO | — | — | Hardened by default |\n| **Envoy ≥ 1.20** | NO | NO | partial | partial | Hardened in most paths |\n| **HAProxy ≤ 2.4** | ✓ | ✓ | — | — | **Vulnerable**, see CVE-2021-40346 |\n| **AWS ALB + specific upstream** | partial | partial | ✓ | ✓ | Several disclosed-paid reports 2022-2024 |\n| **Cloudflare → S3 / Lambda chains** | — | — | ✓ | ✓ | H2-downgrade attacks remain viable |\n| **Older F5 BIG-IP (TMM < 16)** | ✓ | — | — | — | Vendor advisories |\n| **Citrix ADC / NetScaler (older firmware)** | ✓ | ✓ | — | — | Disclosed in 2020-2022 |\n| **Squid 3.x** | ✓ | — | — | — | Older deployments |\n| **Apache Traffic Server (older)** | ✓ | ✓ | ✓ | ✓ | PortSwigger research |\n| **Custom Python / Go proxies** | ✓ | ✓ | — | — | Frequently miss RFC enforcement |\n\n### Operator fingerprint quick-check\n\n```bash\ncurl -sI https://target/ | grep -i \"Server:\"\n```\n\n- `nginx/1.21+`, `Caddy`, `envoy` → CL/TE classic is dead — pivot to H2.CL/H2.TE if the front-end speaks HTTP/2, or look for legacy proxies upstream\n- `HAProxy`, header points to AWS/CDN → run the full payload matrix\n- No Server header → assume hardened, but run a single quick `space-before-colon` probe; if it doesn't 400, dig deeper\n\n### H2.CL / H2.TE (the modern dominant vector)\n\nH2-downgrade smuggling attacks rely on the front-end speaking HTTP/2 to the client and HTTP/1.1 to origin. The downgrade introduces CL/TE confusion because HTTP/2's frame-length headers don't survive the conversion cleanly. Most CDN+origin chains in 2024-2026 use this exact topology.\n\nTools that send HTTP/2 raw frames (Burp Pro's HTTP Request Smuggler extension, `h2csmuggler`, `smuggler.py`) are the right starting point against CDN-fronted targets. Avoid HTTP/1.1-only test clients (curl, raw sockets) against H2-front-ended targets — you'll send the wrong protocol entirely.\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-cache-poison`** — Smuggling + cache is the canonical critical chain; one smuggled request becomes the cached response for every subsequent victim. Chain primitive: CL.TE smuggle a request whose response body contains attacker HTML/JS → front-end cache stores it under a popular URL (`/`, `/login`) → de-sync poisoning where the smuggled request becomes the cached response for the next N victims, persisting for the cache TTL.\n- **`hunt-auth-bypass`** — Smuggling reaches internal-only routes that the front-end WAF/auth-proxy filters out. Chain primitive: smuggle `GET /admin/users HTTP/1.1` past the front-end ACL that blocks external `/admin/*` → backend processes the smuggled request as if from a trusted internal source → bypass front-end auth by smuggling internal-routed request → admin data in the response queue.\n- **`hunt-idor`** — Smuggling attaches the NEXT user's session cookies to an attacker-controlled request path. Chain primitive: smuggle `GET /api/me HTTP/1.1` with no cookies → backend pairs it with the next legitimate user's incoming connection cookies → victim's session cookie attached to attacker's smuggled request → attacker reads the response containing victim's PII/tokens.\n- **`hunt-xss`** — Smuggling injects XSS payloads into the response stream of the next victim without ever appearing in a URL parameter. Chain primitive: smuggled request body contains reflected payload that the backend renders into the next response in the queue → next visitor to `/` receives attacker HTML inline → reflected XSS at every visitor without any URL parameter visible to them or to logs.\n- **`security-arsenal`** — Reach for the smuggling payload bank (CL.TE / TE.CL / TE.TE obfuscations, H2.CL downgrade probes, h2csmuggler one-liners, Burp HTTP Request Smuggler extension config) and the time-delay confirmation template before manual hex-editing.\n- **`triage-validation`** — Run the Pre-Severity Gate before claiming Critical: the smuggled-request effect MUST land on a request issued by a different client/session, not your own follow-up. A timing delta in your own browser alone is parser disagreement, not exploitable smuggling.","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-http-smuggling","license":"MIT","category":"document","lang":"en","tokens":1388,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}