Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: HTTP request smuggling, basic TE.CL vulnerability

Scott | Last updated: Sep 20, 2024 09:15AM UTC

I am running through the labs again in prep to take the test. I think this lab has stopped working. Regardless of what I do, it does not seem like the backend is honoring the Content-Length header. I've tried multiple solutions and I have failed to get any kind of desync response from the backend. It seems like the Content-Length header is just flat ignored across the board. For my payload, I am making sure the entire payload is constructed per TE: chunked spec. If it deviates, the frontend (assumed) lets me know by throwing an "invalid request". This includes all of the trailing \r\n chars. Inspector set to HTTP/1 for the Protocol Update Content-Length disabled Thanks!

Ben, PortSwigger Agent | Last updated: Sep 20, 2024 10:25AM UTC