HTTP Request Smuggling

Learn to identify and exploit HTTP request smuggling, covering CL.TE, TE.CL, transfer-encoding obfuscation, browser desync, and HTTP2 smuggling.
In this module, we'll explore an attack that takes advantage of how different web servers interpret HTTP requests. We'll examine the basic techniques of HTTP request smuggling, such as Content-Length/Transfer-Encoding (CL.TE), Transfer-Encoding/Content-Length (TE.CL), and Transfer-Encoding obfuscation. We’ll also cover Browser desync attacks, where attackers disrupt the alignment between the user's browser and the server. Additionally, we'll also look into HTTP2 smuggling, which utilizes the complexity of the HTTP2 protocol to bypass security measures.

0%
HTTP Request Smuggling
Learn about HTTP Request Smuggling and its different techniques.
0%
HTTP/2 Request Smuggling
Exploit HTTP Request Smuggling in HTTP/2 environments.
0%
Request Smuggling: WebSockets
Exploit HTTP Request Smuggling through WebSockets.
0%
HTTP Browser Desync
Learn about Request Smuggling Browser Desync.
0%
El Bandito
Can you help capture El Bandito before he leaves the galaxy?
What are modules?
A learning pathway is made up of modules, and a module is made of bite-sized rooms (think of a room like a mini security lab).
