From 08bb735f1e9db54d542d4b0173aa9636e6c46e9a Mon Sep 17 00:00:00 2001 From: sandiyochristan Date: Sun, 29 Mar 2026 06:26:25 +0530 Subject: [PATCH] fix: correct TE.CL probe, pseudo-header terminology, PoC Content-Length values, \x20 representation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Four reviewer findings addressed: P1 — TE.CL timing-probe description inverted: previous text said 'Content-Length set to fewer bytes than the chunk content' which describes socket-poisoning behavior (differential response), not a timeout. Corrected to: send a complete chunked body with CL set to MORE bytes than provided so the back-end waits for data that never arrives. Also corrected Testing Methodology step 3 to match. P2 — pseudo-header terminology: 'content-length' is a regular HTTP/2 header, not a pseudo-header (pseudo-headers are exclusively :method, :path, :authority, :scheme). Fixed the H2.CL explanation (line 75), HTTP/2-specific detection bullet, and Pro Tip #4 which referred to ':content-length pseudo-header'. P2 — PoC Content-Length values: outer Content-Length in the bypass PoC corrected from 116 to 100 (actual byte count of the body shown); capture PoC corrected from 129 to 120. P2 — \x20 representation: replaced the \x20 escape sequence in the code block (which renders as a literal four-character string, not a space byte) with an explanatory comment and actual whitespace characters so the intent is unambiguous. --- .../vulnerabilities/http_request_smuggling.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/strix/skills/vulnerabilities/http_request_smuggling.md b/strix/skills/vulnerabilities/http_request_smuggling.md index cb5afb59..b90572ac 100644 --- a/strix/skills/vulnerabilities/http_request_smuggling.md +++ b/strix/skills/vulnerabilities/http_request_smuggling.md @@ -72,7 +72,7 @@ SMUGGLED ### H2.CL — HTTP/2 Front-end Downgrades to HTTP/1.1, Injects Content-Length -HTTP/2 has no `Content-Length` vs `TE` ambiguity in its own framing. But when the front-end downgrades to HTTP/1.1 for the back-end, an attacker can inject a `Content-Length` header in the HTTP/2 request pseudo-headers that conflicts with the actual body length: +HTTP/2 has no `Content-Length` vs `TE` ambiguity in its own framing. But when the front-end downgrades to HTTP/1.1 for the back-end, an attacker can inject a `content-length` header in the HTTP/2 request that conflicts with the actual body length. Note: `content-length` is a regular HTTP/2 header — pseudo-headers are exclusively `:method`, `:path`, `:authority`, and `:scheme`: ``` :method POST :path / @@ -107,7 +107,7 @@ A front-end proxy enforces authentication or IP restriction by checking request ```http POST /not-restricted HTTP/1.1 Host: target.com -Content-Length: 116 +Content-Length: 100 Transfer-Encoding: chunked 0 @@ -129,7 +129,7 @@ Poison the back-end socket with a partial request prefix that captures the next ```http POST /search HTTP/1.1 Host: target.com -Content-Length: 129 +Content-Length: 120 Transfer-Encoding: chunked 0 @@ -173,7 +173,7 @@ X ``` If response is delayed 10–30 seconds, CL.TE desync likely. -**TE.CL:** Send a request with `Transfer-Encoding` present but `Content-Length` set to fewer bytes than the chunk content. TE.CL back-end waits for more bytes per Content-Length. +**TE.CL:** Send a request with a complete chunked body (including the `0\r\n\r\n` terminator so the front-end is satisfied) but with `Content-Length` set to **more** bytes than the body actually provides. The back-end, using Content-Length, waits for the remaining bytes that never arrive — producing a 10–30 second timeout. Setting Content-Length *less* than the body causes socket poisoning (differential-response detection), not a timeout. ### Differential Response Detection @@ -183,8 +183,8 @@ Send two requests in sequence. If the second request receives an unexpected resp ```http Transfer-Encoding: xchunked # non-standard value, some FE ignore, BE accept -Transfer-Encoding:\x20chunked # leading space -Transfer-Encoding: chunked # tab before value +Transfer-Encoding: chunked # leading space before value (0x20 byte after colon+space) +Transfer-Encoding: chunked # tab character before value Transfer-Encoding: x Transfer-Encoding: chunked # duplicate TE headers, BE uses last ``` @@ -201,7 +201,7 @@ Transfer-Encoding: chunked\r\nTransfer-Encoding: x # TE twice ## HTTP/2-Specific Detection -- Send HTTP/2 requests with injected `content-length` pseudo-headers that differ from the actual body length +- Send HTTP/2 requests with an injected `content-length` regular header that differs from the actual body length - Inject `transfer-encoding: chunked` in HTTP/2 headers (spec-forbidden but sometimes passed through) - Use HTTP/2 header injection: inject newlines in header values if the front-end passes them to HTTP/1.1 back-end unescaped - Observe whether the HTTP/2 connection ID corresponds to a persistent HTTP/1.1 connection to the back-end (connection reuse amplifies impact) @@ -210,7 +210,7 @@ Transfer-Encoding: chunked\r\nTransfer-Encoding: x # TE twice 1. **Map the proxy chain** — identify front-end (CDN, load balancer, WAF) and back-end (app server) 2. **Probe CL.TE** — send a timing probe with mismatched chunked terminator; observe delay -3. **Probe TE.CL** — send a timing probe with Content-Length shorter than chunked content +3. **Probe TE.CL** — send a timing probe with complete chunked body but Content-Length larger than the actual body; observe back-end timeout 4. **Obfuscate TE header** — try each obfuscation variant (tab, extra space, duplicate, non-standard value) 5. **Confirm with differential response** — send two rapid identical requests; if second gets an unexpected response, socket is poisoned 6. **Attempt bypass exploit** — craft a smuggled `GET /admin` or restricted endpoint and observe if back-end accepts it @@ -245,7 +245,7 @@ Transfer-Encoding: chunked\r\nTransfer-Encoding: x # TE twice 1. Use Burp Suite's HTTP Request Smuggler extension as a rapid scanner, but always confirm manually — false positives are common 2. TE obfuscation is the most reliable path; `Transfer-Encoding: xchunked` works on many Apache/IIS back-ends 3. Keep smuggled prefixes short during detection; use the minimal body to confirm desync before attempting capture attacks -4. H2.CL is the most impactful modern variant — many CDNs translate HTTP/2 to HTTP/1.1 and inject `Content-Length` from the `:content-length` pseudo-header +4. H2.CL is the most impactful modern variant — many CDNs translate HTTP/2 to HTTP/1.1 and derive `Content-Length` from the `content-length` regular header sent in the HTTP/2 request (not a pseudo-header — inject it as a normal header field) 5. In capture attacks, set `Content-Length` in the smuggled prefix larger than your partial body by 50–100 bytes to catch a full auth header from the next user 6. Test during low-traffic periods first to avoid affecting real users; always get explicit authorization for capture attempts 7. If timing probes are inconsistent, pipeline two requests over the same connection and look for unexpected response swapping