Download to read offline
Uploaded byn|u - The Open Security Community
Http request smuggling
This document discusses HTTP request smuggling vulnerabilities. It begins with an introduction and overview of what will be covered. It then explains where the vulnerability lies in potential desynchronization between how a front-end server and back-end server determine the end of a request. Several examples of different types of desynchronization are provided, including using different content length and transfer encoding headers. Exploitation scenarios and prevention methods are also summarized.
More Related Content
More from n|u - The Open Security Community
Http request smuggling
- 1.
- 2. ● Worked asa security analyst ● Cop trainer ● Active Null Ahmedabad volunteer ● A neophyte ● Also, a student About me
- 3. What are wegoing to cover? Core concepts Types of request smuggling Practical example of attack Exploitation scenarios Prevention 2 3 4 5 6 Where does the vulnerability lie? 1
- 4. A visualization ofhigh-traffic websites example.com example.com example.com’ s load balancer Users Front-end server Back-end server
- 5.
- 6. The chunked Transfer-Encoding ●Transfer-Encoding: chunked is used to transfer data in chunks ● For example: 5rn Hellorn 8rn Everyonern 0rn rn Chunk 1 Chunk 2 Terminating Chunk
- 7. 1. Using Content-Length2. Using Transfer-Encoding Two ways to decide where the request ends POST / HTTP/1.1 Host: example.com Content-Length: 5 Hello POST / HTTP/1.1 Host: example.com Transfer-Encoding: chunked 5 Hello 8 Everyone 0
- 8. Vulnerability ● Vulnerability arisesin desynchronization in deciding how the content ends between front-end server and back-end server ● Desynchronisation include: ○ Content-Length - Transfer-Encoding or CL.TE ○ Transfer-Encoding - Content-Length or TE.CL ○ Transfer-Encoding - Transfer-Encoding or TE.TE
- 9. CL.TE Desynchronization POST /HTTP/1.1 Host: example.com Content-Length: 10 Transfer-Encoding: chunked 0 Hello Actual Request POST / HTTP/1.1 Host: example.com Content-Length: 10 Transfer-Encoding: chunked 0 Hello What front-end server sees POST / HTTP/1.1 Host: example.com Content-Length: 10 Transfer-Encoding: chunked 0 HelloGET / HTTP/1.1 Host: example.com What back-end server sees
- 10. TE.CL Desynchronization POST /HTTP/1.1 Host: example.com Content-Length: 2 Transfer-Encoding: chunked 3 Foo 0 POST / HTTP/1.1 Host: example.com Content-Length: 2 Transfer-Encoding: chunked 3 Foo 0 POST / HTTP/1.1 Host: example.com Content-Length: 2 Transfer-Encoding: chunked 3 Foo 0GET / HTTP/1.1 Host: example.com Actual Request What front-end server sees What back-end server sees
- 11. TE.TE Desynchronization POST /HTTP/1.1 Host: example.com Content-Length: 8 Transfer-Encoding: chunked Transfer-Encoding: foo 0 Hello POST / HTTP/1.1 Host: example.com Content-Length: 8 Transfer-Encoding: chunked Transfer-Encoding: foo 0 Hello POST / HTTP/1.1 Host: example.com Content-Length: 8 Transfer-Encoding: chunked Transfer-Encoding: foo 0 HelloGET / HTTP/1.1 Host: example.com Actual Request What front-end server sees What back-end server sees
- 12.
- 13. Exploitation ● Open Redirection ●Access control restriction bypass ● Web cache poisoning ● Web cache deception ● Exposing rewritten requests ● Reflected XSS ● Capturing other user’s requests
- 14. Prevention 1. Do notuse load balancers 2. If used, configure them properly to only accept what is acceptable by both the front-end server and the back-end server 3. Configuring front-end server to normalize ambiguous requests
- 15. Special Thanks ● NullAhmedabad ● James Kettle ● Portswigger web security academy ● Mentors ● SlidesGo
- 16.