Pasindu's Blog

HTTP request smuggling, confirming a TE.CL vulnerability via differential responses

2 min read

PortSwigger

Lab Description

This lab involves a front-end and back-end server, and the back-end server doesn’t support chunked encoding.

Objective: Smuggle a request to the back-end server, so that a subsequent request for / (the web root) triggers a 404 Not Found response.

Step 1: Understanding the Vulnerability

The TE.CL vulnerability:

  • Front-end server: Uses Transfer-Encoding: chunked (TE) — supports chunked encoding
  • Back-end server: Uses Content-Length (CL) — doesn’t support chunked encoding
  • The discrepancy allows request smuggling

The detection technique:

  • Smuggle a request to a non-existent endpoint (/404)
  • The back-end processes this smuggled request
  • A subsequent normal request to / gets interpreted incorrectly
  • The response becomes 404 Not Found instead of 200 OK

Step 2: The Smuggling Payload

Step 2.1: Important Preparation

Ensure “Update Content-Length” is unchecked:

  1. Go to Repeater menu
  2. Uncheck “Update Content-Length”

Step 2.2: Send the Following Request

POST / HTTP/1.1
Host: YOUR-LAB-ID.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked

5e
POST /404 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15

x=1
0

Important: Include the trailing \r\n\r\n after the final 0.

Step 2.3: Request Breakdown

ServerUsesSees
Front-endTransfer-Encoding: chunkedProcesses chunk size 5e (94 bytes) → forwards
Back-endContent-Length: 4Only reads first 4 bytes (“POST”)

The back-end’s buffer now contains: /404 HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 15\r\n\r\nx=1

Step 3: Why You Need to Send the Request Twice

First request:

  • Poisons the back-end’s buffer with the smuggled POST /404

Second request:

  • The back-end processes the smuggled request from the buffer
  • Returns 404 Not Found for the smuggled /404 request
  • A subsequent normal request to / may also be affected

Step 4: Differential Response

When the vulnerability is confirmed:

  • A request to / (the web root) returns 404 Not Found instead of 200 OK

From your screenshot: The final solved status confirms the lab was completed successfully.

Step 5: Lab Solved

Success message displayed:

Graph View