← Back to Courses/Web Pentest
IntermediateFREE29 hours

HTTP Request Smuggling

// VULNERABLE: Inconsistent Content-Length vs Transfer-Encoding parsing (CL.TE)

Enroll for free to track your progress through this course.

Curriculum (58 lessons)

  1. 1. HTTP Request Smuggling
  2. 2. What Is HTTP Request Smuggling?
  3. 3. What Happens in an HTTP Request Smuggling Attack?
  4. 4. How Do HTTP Request Smuggling Vulnerabilities Arise?
  5. 5. How to Perform an HTTP Request Smuggling Attack
  6. 6. How to Identify HTTP Request Smuggling Vulnerabilities
  7. 7. How to Exploit HTTP Request Smuggling Vulnerabilities
  8. 8. Advanced HTTP Request Smuggling
  9. 9. Browser-Powered Request Smuggling
  10. 10. How to Prevent HTTP Request Smuggling Vulnerabilities HTTP Request Smuggling Vulnerabiliti
  11. 11. Finding HTTP Request Smuggling Vulnerabilities
  12. 12. Finding HTTP Request Smuggling Vulnerabilities Using Timing Techniques the Most Generally
  13. 13. Confirming HTTP Request Smuggling Vulnerabilities Using Differential Responses When a Prob
  14. 14. Exploiting HTTP Request Smuggling Vulnerabilities
  15. 15. Using HTTP Request Smuggling to Bypass Front-End Security Controls in Some Applications, t
  16. 16. Revealing Front-End Request Rewriting
  17. 17. Bypassing Client Authentication
  18. 18. Capturing Other Users' Requests
  19. 19. Using HTTP Request Smuggling to Exploit Reflected XSS
  20. 20. Using HTTP Request Smuggling to Turn an on-Site Redirect Into an Open Redirect Many Applic
  21. 21. Using HTTP Request Smuggling to Perform Web Cache Poisoning in a Variation of the Precedin
  22. 22. Using HTTP Request Smuggling to Perform Web Cache Deception in Yet Another Variant of the
  23. 23. Advanced Request Smuggling
  24. 24. HTTP/2 Request Smuggling in This Section, We'Ll Show You How, Contrary to Popular Belief,
  25. 25. Response Queue Poisoning
  26. 26. Request Smuggling via CRLF Injection
  27. 27. HTTP/2 Request Splitting When We Looked at Response Queue Poisoning, You Learned How to Sp
  28. 28. HTTP Request Tunnelling
  29. 29. HTTP/2-Exclusive Vectors
  30. 30. Injecting via Header Names
  31. 31. Injecting via Pseudo-Headers HTTP/2 Doesn'T Use a Request Line or Status Line. Instead, Th
  32. 32. What Is the Impact of Response Queue Poisoning?
  33. 33. How to Construct a Response Queue Poisoning Attack
  34. 34. Request Tunnelling with HTTP/2 Request Tunnelling Is Possible with Both HTTP/1 and HTTP/2
  35. 35. Leaking Internal Headers via HTTP/2 Request Tunnelling When Request Tunnelling Is Your Onl
  36. 36. Blind Request Tunnelling
  37. 37. Non-Blind Request Tunnelling Using HEAD
  38. 38. Web Cache Poisoning via HTTP/2 Request Tunnelling Even Though Request Tunnelling Is Genera
  39. 39. HTTP/2 Downgrading
  40. 40. What Risks Are Associated with HTTP/2 Downgrading?
  41. 41. CL.0 Request Smuggling Back-End Servers Can Sometimes Be Persuaded to Ignore the `Content-
  42. 42. Client-Side Desync Attacks
  43. 43. Pause-Based Desync Attacks
  44. 44. CL.0 Request Smuggling
  45. 45. Testing for CL.0 Vulnerabilities to Probe for CL.0 Vulnerabilities, First Send a Request C
  46. 46. Eliciting CL.0 Behavior If You Can'T Find Any Endpoints That Appear Vulnerable, You Can Tr
  47. 47. Exploiting CL.0 Vulnerabilities You Can Exploit CL.0 Vulnerabilities for the Same Server-S
  48. 48. H2.0 Vulnerabilities Websites That Downgrade HTTP/2 Requests to HTTP/1 May Be Vulnerable t
  49. 49. How to Prevent CL.0 Vulnerabilities for Some High-Level Measures You Can Take to Prevent C
  50. 50. What Is a Client-Side Desync Attack?
  51. 51. Testing for Client-Side Desync Vulnerabilities
  52. 52. Exploiting Client-Side Desync Vulnerabilities
  53. 53. How to Prevent Client-Side Desync Vulnerabilities
  54. 54. Server-Side Pause-Based Desync
  55. 55. Client-Side Pause-Based Desync
  56. 56. How to Prevent Pause-Based Desync Vulnerabilities
  57. 57. Best Practices & Detailed Takeaways
  58. 58. CL-TE Smuggle: Frontend Uses CL, Backend Uses TE

Course price

Free

  • 58 lessons
  • Lifetime access
  • 0 students enrolled
Sign In to Enroll