gitea-mirror/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-12-12 07:40:34 -08:00
Code Issues Packages Projects Releases Wiki Activity

Normalize page header for SSTI, SAML, SSI

Browse Source
This commit is contained in:
Swissky
2024-11-10 19:14:16 +01:00
parent 1a3e605d64
commit a338b2f12a
13 changed files with 105 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
Request Smuggling/README.md
View File

@@ -1,16 +1,21 @@
!# Request Smuggling
# Request Smuggling
> HTTP Request smuggling occurs when multiple "things" process a request, but differ on how they determine where the request starts/ends. This disagreement can be used to interfere with another user's request/response or to bypass security controls. It normally occurs due to prioritising different HTTP headers (Content-Length vs Transfer-Encoding), differences in handling malformed headers (eg whether to ignore headers with unexpected whitespace), due to downgrading requests from a newer protocol, or due to differences in when a partial request has timed out and should be discarded.
## Summary
* [Tools](#tools)
* [Methodology](#methodology)
* [CL.TE Vulnerabilities](#cl.te-vulnerabilities)
* [TE.CL Vulnerabilities](#te.cl-vulnerabilities)
* [TE.TE Vulnerabilities](#tete-vulnerabilities)
* [HTTP/2 Request Smuggling](#http2-request-smuggling)
* [Client-Side Desync](#client-side-desync)
* [Labs](#labs)
* [CL.TE vulnerabilities](#cl.te-vulnerabilities)
* [TE.CL vulnerabilities](#te.cl-vulnerabilities)
* [TE.TE behavior: obfuscating the TE header](#te.te-behavior-obfuscating-the-te-header)
* [References](#references)
## Tools
* [bappstore/HTTP Request Smuggler](https://portswigger.net/bappstore/aaaa60ef945341e8a450217a54a11646) - An extension for Burp Suite designed to help you launch HTTP Request Smuggling attacks
@@ -18,23 +23,14 @@
* [dhmosfunk/simple-http-smuggler-generator](https://github.com/dhmosfunk/simple-http-smuggler-generator) - This tool is developed for burp suite practitioner certificate exam and HTTP Request Smuggling labs.
## Labs
* [PortSwigger - HTTP request smuggling, basic CL.TE vulnerability](https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te)
* [PortSwigger - HTTP request smuggling, basic TE.CL vulnerability](https://portswigger.net/web-security/request-smuggling/lab-basic-te-cl)
* [PortSwigger - HTTP request smuggling, obfuscating the TE header](https://portswigger.net/web-security/request-smuggling/lab-ofuscating-te-header)
* [PortSwigger - Response queue poisoning via H2.TE request smuggling](https://portswigger.net/web-security/request-smuggling/advanced/response-queue-poisoning/lab-request-smuggling-h2-response-queue-poisoning-via-te-request-smuggling)
* [PortSwigger - Client-side desync](https://portswigger.net/web-security/request-smuggling/browser/client-side-desync/lab-client-side-desync)
## About CL.TE | TE.CL Vulnerabilities
## Methodology
If you want to exploit HTTP Requests Smuggling manually you will face some problems especially in TE.CL vulnerability you have to calculate the chunk size for the second request(malicious request) as PortSwigger suggests `Manually fixing the length fields in request smuggling attacks can be tricky.`.
For that reason you can use the [Simple HTTP Smuggler Generator CL.TE TE.CL](https://github.com/dhmosfunk/simple-http-smuggler-generator) and exploit the CL.TE TE.CL vulnerabilities manually and learn how this vulnerability works and how you can exploit it.
## CL.TE vulnerabilities
### CL.TE Vulnerabilities
> The front-end server uses the Content-Length header and the back-end server uses the Transfer-Encoding header.
@@ -65,7 +61,7 @@ G
```
## TE.CL vulnerabilities
### TE.CL Vulnerabilities
> The front-end server uses the Transfer-Encoding header and the back-end server uses the Content-Length header.
@@ -104,7 +100,7 @@ x=1
:warning: To send this request using Burp Repeater, you will first need to go to the Repeater menu and ensure that the "Update Content-Length" option is unchecked.You need to include the trailing sequence \r\n\r\n following the final 0.
## TE.TE behavior: obfuscating the TE header
### TE.TE Vulnerabilities
> The front-end and back-end servers both support the Transfer-Encoding header, but one of the servers can be induced not to process it by obfuscating the header in some way.
@@ -133,7 +129,7 @@ header ignored\r\n\r\nGET / HTTP/1.1\r\nHost: www.example.com
```
## Client-side desync
## Client-Side Desync
On some paths, servers don't expect POST requests, and will treat them as simple GET requests, ignoring the payload, eg:
@@ -178,6 +174,15 @@ www.example.com now incorrectly processes the HEAD request in the POST's body, i
Since the browser only sent one request, it accepts the response to the HEAD request as the response to its GET request and interprets the third and fourth responses as the body of the response, and thus executes the attacker's script.
## Labs
* [PortSwigger - HTTP request smuggling, basic CL.TE vulnerability](https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te)
* [PortSwigger - HTTP request smuggling, basic TE.CL vulnerability](https://portswigger.net/web-security/request-smuggling/lab-basic-te-cl)
* [PortSwigger - HTTP request smuggling, obfuscating the TE header](https://portswigger.net/web-security/request-smuggling/lab-ofuscating-te-header)
* [PortSwigger - Response queue poisoning via H2.TE request smuggling](https://portswigger.net/web-security/request-smuggling/advanced/response-queue-poisoning/lab-request-smuggling-h2-response-queue-poisoning-via-te-request-smuggling)
* [PortSwigger - Client-side desync](https://portswigger.net/web-security/request-smuggling/browser/client-side-desync/lab-client-side-desync)
## References
- [A Pentester's Guide to HTTP Request Smuggling - Busra Demir - October 16, 2020](https://www.cobalt.io/blog/a-pentesters-guide-to-http-request-smuggling)