Lab: Exploiting HTTP request smuggling to bypass front end security controls, CL.TE ...
After starting the exercise, the blog should look similar to the one shown in the following illustration.
Now, if we enter the path /admin in the address bar and try to access the website, we get the message "Path /admin is blocked".
We now switch to Burp Proxy and search for the request GET /. We then send this to the Burp Repeater using the key combination CTRL + R. The request can also be sent to the Burp Repeater via the context menu. Right-click on the request -> select Send to Repeater. We then switch to Burp Repeater. In some cases, HTTP/2 may be used. In this rare case, you must switch to HTTP/1.1 via the Inspector.
The request in Burp Repeater should now look similar to the following request.
In the first step, we change the request method from GET to POST. To do this, we right-click and select Change request method. This inserts the header Content-Length: 0 at the end of our request. We now add the Transfer-Encoding: header with the value chunked to the end of the request. Now we need to adjust the body of the request. We press the ENTER key twice and insert a 0, then press the ENTER key twice again and append the following request.
The complete request should now look like this:
We now send this request twice to the application and should then receive the following response.
In line 53, we see the message "Admin interface only available to local users". This indicates that we should add the Host: localhost header to our appended request. The request should now look like this.
If we now send this request twice to the application, we receive the following response.
We will now expand the attached request with the following lines.
If we now send this request twice to the application, we receive the following response and now have access to the admin panel.
We will now modify the attached request so that we can delete the user carlos. To do this, we will modify the first line as follows:
The complete request looks as follows:
We now execute this request twice and have then successfully completed the exercise.
Video solution
Last updated