Lab: HTTP request smuggling, obfuscating the TE header
After starting the exercise, the blog should look similar to the one shown in the following illustration.
Most of this exercise will be carried out using Burp Suite. We will now switch to Burp Suite and open Burp Proxy. In Burp Proxy, we will open the HTTP history tab and search for the first request that calls up the blog.
We send this request to the Burp Repeater using the key combination CTRL + R. The request can also be sent to the repeater via the context menu. Right-click on the request -> select Send to Repeater. We then switch to the Burp Repeater. In some cases, HTTP/2 may be used. In this rare case, you must switch to HTTP/1.1 via the Inspector.
The request in Burp Repeater should now look similar to the following request.
The next step is to disable the Update Content-Length function in the Burp Repeater menu. Then, we change the request method from GET to POST. To do this, we right-click and select Change request method. This inserts the header Content-Length: 0 at the end of our request. We change the value of the Content-Length header to 4, as this request should only be 4 bytes long; the payload is in the attached request. We now add two Transfer-Encoding: headers to the end of the request. The value of the first Transfer-Encoding header is chunked. This is the regular Transfer-Encoding header, while the second Transfer-Encoding header contains the value cow and is the header that can only be read by the backend server. Now we need to adjust the body of the request. This body is the same as in the previous exercise and can be copied from there.
5c bytes (92 in decimal) is the total length of the request, including the two line breaks after the 0 in hexadecimal. 5c itself is not counted. The complete request should now look like this:
The complete request:
We now send this request twice to the application and should then receive the following response.
When this response appears, the exercise has been successfully completed.
Video solution
Last updated