Skip to main content

29. Getting a Feel for HTTP Request Smuggling

Request smuggling occurs when a proxy or load balancer and its backend interpret request boundaries differently. A common combination is disagreement over Content-Length and Transfer-Encoding: chunked.

Core Idea​

  • The frontend trusts Content-Length, while the backend trusts chunked
  • An attacker hides a second request after a "fake body"
  • This can lead to cache poisoning, session hijacking, or access to administrator routes

Simple Test Flow​

  • Identify the proxy and backend combination, such as nginx↔node or haproxy↔apache
  • Break response synchronization with payloads that manipulate TE and CL
  • Mixed responses strongly indicate possible smuggling

In real systems, this is difficult to detect because it can look normal in logs. Do not rely on a WAF alone; aligning request-boundary handling between the proxy and backend is the first priority.